Enforce identity cert to match ssh cert on renewals.

smallstep · Aug 23, 2021 · 568fce2 · 568fce2
1 parent a3028bb
commit 568fce2
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 5 deletions.
diff --git a/api/sshRekey.go b/api/sshRekey.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"net/http"
+	"time"
 
 	"github.com/pkg/errors"
 	"github.com/smallstep/certificates/authority/provisioner"
@@ -72,7 +73,11 @@ func (h *caHandler) SSHRekey(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	identity, err := h.renewIdentityCertificate(r)
+	// Match identity cert with the SSH cert
+	notBefore := time.Unix(int64(oldCert.ValidAfter), 0)
+	notAfter := time.Unix(int64(oldCert.ValidBefore), 0)
+
+	identity, err := h.renewIdentityCertificate(r, notBefore, notAfter)
 	if err != nil {
 		WriteError(w, errs.ForbiddenErr(err))
 		return

diff --git a/api/sshRenew.go b/api/sshRenew.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"net/http"
+	"time"
 
 	"github.com/pkg/errors"
 	"github.com/smallstep/certificates/authority/provisioner"
@@ -62,7 +63,11 @@ func (h *caHandler) SSHRenew(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	identity, err := h.renewIdentityCertificate(r)
+	// Match identity cert with the SSH cert
+	notBefore := time.Unix(int64(oldCert.ValidAfter), 0)
+	notAfter := time.Unix(int64(oldCert.ValidBefore), 0)
+
+	identity, err := h.renewIdentityCertificate(r, notBefore, notAfter)
 	if err != nil {
 		WriteError(w, errs.ForbiddenErr(err))
 		return
@@ -74,13 +79,24 @@ func (h *caHandler) SSHRenew(w http.ResponseWriter, r *http.Request) {
 	}, http.StatusCreated)
 }
 
-// renewIdentityCertificate request the client TLS certificate if present.
-func (h *caHandler) renewIdentityCertificate(r *http.Request) ([]Certificate, error) {
+// renewIdentityCertificate request the client TLS certificate if present. If notBefore and notAfter are passed the
+func (h *caHandler) renewIdentityCertificate(r *http.Request, notBefore, notAfter time.Time) ([]Certificate, error) {
 	if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
 		return nil, nil
 	}
 
-	certChain, err := h.Authority.Renew(r.TLS.PeerCertificates[0])
+	cert := r.TLS.PeerCertificates[0]
+
+	// Enforce the cert to match another certificate, for example an ssh
+	// certificate.
+	if !notBefore.IsZero() {
+		cert.NotBefore = notBefore
+	}
+	if !notAfter.IsZero() {
+		cert.NotAfter = notAfter
+	}
+
+	certChain, err := h.Authority.Renew(cert)
 	if err != nil {
 		return nil, err
 	}