Add CA on Mac

Short-lived certificates (legacy) · Cloudflare Zero Trust docs

Cloudflare Access can replace traditional SSH keys with short-lived certificates issued to your users based on the token generated by their Access login. In traditional models, users generate an SSH keypair and administrators grant access to individual SSH servers by deploying their users' public keys to those servers. These SSH keys can remain unchanged on these servers for months or years. Cloudflare Access removes the burden of managing SSH keys, while also improving security by replacing long-lived SSH keys with ephemeral SSH certificates.

https://developers.cloudflare.com/cloudflare-one/applications/non-http/short-lived-certificates-legacy/

• Generate CA on Cloudflared Dashboard
Generate a short-lived certificate public key
1. In Zero Trust, go to Access > Service auth > SSH.
2. In the Application dropdown, choose the Access application that represents your SSH server.
3. Select Generate certificate. A row will appear with a public key scoped to your application.
4. Save the key or keep it somewhere convenient for configuring your server. You can return to copy this public key any time in the Service Auth dashboard.

• Save your public key
1. Copy the public key generated from the dashboard in Step 3.
2. Use the following command to change directories to the SSH configuration directory on the remote target machine:
3. Once there, you can use the following command to both generate the file and open a text editor to input/paste the public key.
4. In the ca.pub file, paste the public key without any modifications.
 
ca.pub ecdsa-sha2-nistp256 <redacted> open-ssh-ca@cloudflareaccess.org
The ca.pub file can hold multiple keys, listed one per line. Empty lines and comments starting with # are also allowed.

• configuration
Modify your SSHD config
The following procedure makes two changes to the sshd_config file on the remote target machine. The first change requires that you uncomment a field already set in most default configurations; the second change adds a new field.
1. While staying within the /etc/ssh directory on the remote machine, open the sshd_configfile.
2. Go to the row named PubkeyAuthentication. In most default configurations, the row will appear commented out as follows:
3. Remove the # symbol to uncomment the line:
4. Add a new line below PubkeyAuthentication:

Restart ssh service on Mac