Skip to content

Support host certificates in gitlab-sshd

Summary

We need to add config support for the host_cert_files parameter for gitlab-sshd. This was added in gitlab-org/gitlab-shell!661 (merged).

host_cert_files contains a list of signed certificates for the server's host keys. This is equivalent to OpenSSH's HostCertificate parameter.

The idea here is that some certificate authority signs off on the server's keys, and gitlab-sshd publishes these certificates so clients don't have to rely on manual fingerprint checking.

There will likely be one certificate per host key used. We'll probably want to pass the content of the public keys in as a Kubernetes secret, and then save them to a mount that gitlab-sshd can access.