feat: regenerate --temporary

Sponsored-by: author

2 files changed, 36 insertions, 0 deletions

diff --git a/src/cmd/host.rs b/src/cmd/host.rs
index c508137..fdaff19 100644
--- a/src/cmd/host.rs
+++ b/src/cmd/host.rs
@@ -340,6 +340,10 @@ pub struct Regenerate {
     /// Name of host.
     hostname: String,
 
+    /// Make the generated host key short-lived.
+    #[clap(long)]
+    temporary: bool,
+
     /// All the principals for this host. Defaults to HOSTNAME if none
     /// given.
     #[clap(short, long = "principal", action = ArgAction::Append)]
@@ -354,6 +358,17 @@ impl Runnable for Regenerate {
             }
             let pair = KeyPair::generate(KeyKind::Ed25519).map_err(CAError::KeyError)?;
             host.set_keys(pair.public().clone(), pair.private().clone());
+            if self.temporary {
+                let now = std::time::SystemTime::now();
+                if let Some(valid_until) = time::OffsetDateTime::from(now).checked_add(SHORT_TIME) {
+                    let format =
+                        format_description!("[year]:[month]:[day]T[hour]:[minute]:[second]");
+                    let valid_until = valid_until.format(&format).map_err(CAError::TimeFormat)?;
+                    host.set_valid_until(valid_until);
+                } else {
+                    return Err(CAError::ShortTime);
+                };
+            }
             Ok(())
         } else {
             Err(CAError::KeyStoreError(KeyStoreError::UnknownHost(
diff --git a/sshca.md b/sshca.md
index dcec155..e7f4867 100644
--- a/sshca.md
+++ b/sshca.md
@@ -594,6 +594,27 @@ when I run sshca host private-key myhost
 then stdout contains "-----BEGIN OPENSSH PRIVATE KEY-----"
 ~~~
 
+### Re-generate a temporary host key
+
+_Requirement: we can generate a new short-lived host key for an
+existing host that already has a private key._
+
+Justification: when a host key is generated for installing a new host,
+it should be replaced soon. The `sshca` tool should allow marking the
+installation host key as short-lived, so that it can't be used for
+long.
+
+~~~scenario
+given an installed sshca
+given file .config/sshca/config.yaml from config.yaml
+
+when I run sshca host generate myhost
+when I run sshca host regenerate --temporary myhost
+
+when I try to run sshca host public-key --now=3000-01-01T00:00:00 myhost
+then command fails
+~~~
+
 ### Export host public and private keys
 
 _Requirement: It must be possible to export a host's public key, and