ssoosshd sign
Signer mode runs only the certificate signing component: it consumes signing requests from the message broker (NATS) and publishes signed certificates. This mode requires:
- NATS broker configured (gochannel is not supported for multi-process)
- CA private key location (via ssh_key config)
- mTLS credentials for NATS (cert_file, key_file, ca_file)
No database, HTTP server, or OIDC/LDAP configuration is needed. Use this to isolate the signer from the webserver’s attack surface.
Synopsis
Section titled “Synopsis”ssoosshd sign [flags] [args]Global options
Section titled “Global options”Inherited from ssoosshd and its parents.
| Flag | Type | Default | Description |
|---|---|---|---|
-c, --config |
string | path to the ssoosshd config file |