adding ssh host signing

files/ssh-hostcert/README.md

@@ -0,0 +1,82 @@
+# fleet-ssh-hostcert — SSH host certificate client
+
+At boot, gets this host's **per-boot SSH host key** signed by the **fleet SSH CA**
+(step-ca) so administrators trust every fleet host via a single `@cert-authority`
+line in `known_hosts` — instead of trust-on-first-use (TOFU) on a key that changes
+every boot. Closes **F-02 / POA&M P-17**. Full design: `docs/ssh-host-certificate-design.md`.
+
+## Why
+
+The diskless root is a RAM overlay, so `sshd-keygen@` regenerates the SSH host
+keys **every boot** (see `scripts/extract-artifacts.sh`). Clients can therefore
+never pin a host key — every admin SSH connection is TOFU, and a LAN MITM is
+undetectable client-side. A CA-signed **host certificate** removes TOFU fleet-wide:
+the key can stay ephemeral; trust comes from the CA, not the key.
+
+## How (Design A — per-boot key + boot-time cert)
+
+1. Load the **TPM identity** (persistent handle `0x81000100` + leaf cert in NV
+   `0x01800100`) and build an **mTLS client cert** from it — the same identity used
+   for 802.1X, the NVMe hostnqn and agent mTLS. The private key never leaves the TPM.
+2. Read the fresh `/etc/ssh/ssh_host_ecdsa_key.pub`.
+3. `POST` it to the **enrol-broker host plane** (`/ssh/hostcert`) over mTLS. The
+   broker verifies the client cert to the fleet CA (⇒ an enrolled host) and has
+   step-ca sign an SSH **host** cert — the broker, not the host, holds the CA
+   provisioner credential, so step-ca stays behind the single front door.
+4. Write `/etc/ssh/ssh_host_ecdsa_key-cert.pub` + a `HostCertificate` sshd drop-in
+   (`60-hostcert.conf`), then `systemctl reload sshd`.
+
+**Fail-open:** any failure (no network, broker/CA down, host not yet enrolled)
+exits non-zero **without touching sshd** — the host keeps serving its bare per-boot
+key (today's behaviour). It never installs a missing/broken `HostCertificate` that
+would stop sshd from starting. `ssh-hostcert.timer` retries (boot + hourly); a
+signed cert lands once the broker is reachable.
+
+## Identity model / invariants
+
+- **No per-host state in the image** (invariant #1): the broker DNS name in
+  `ssh-hostcert.env` is fleet-generic; the host identity comes from the TPM at
+  runtime. Principals default to the runtime hostname (never baked).
+- **Reuses the one TPM identity** ("one identity, N stages") as the mTLS client
+  auth to the broker — the SSH host key itself is a separate ephemeral key, so this
+  does not add cross-protocol signing exposure to the identity key (cf. F-06).
+
+## Config
+
+Fleet-generic knobs in `ssh-hostcert.env` (installed to `/etc/ssh-hostcert/`):
+`SSH_HOSTCERT_BROKER_URL` (the enrol-broker host-plane endpoint),
+`SSH_HOSTCERT_CACERT`, `SSH_HOSTCERT_HANDLE`/`_NVINDEX`, `SSH_HOSTCERT_PRINCIPALS`.
+All are also `-flags` for `fleet-ssh-hostcert`.
+
+## Build / test
+
+Pure Go (go-tpm, `CGO_ENABLED=0`), one static reproducible binary like
+`fleet-enrol`/`fleet-agent`; deps pinned by `go.sum`. Built **out of the VM** by
+CI and file-provisioned into the rootfs (Packer `2b-ssh-hostcert`, gated on
+`enable_ssh_hostcert`).
+
+```
+cd files/ssh-hostcert
+CGO_ENABLED=0 go test ./...
+CGO_ENABLED=0 GOTOOLCHAIN=local go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o bin/fleet-ssh-hostcert .
+```
+
+## Serving side (once per environment)
+
+`serving/dot1x-bench/step-ca/ssh-ca-bootstrap.sh` enables step-ca's SSH CA, allows
+the `enrol` provisioner to issue SSH host certs, issues the broker host-plane
+server cert, and prints the admin `@cert-authority` line. The broker host plane is
+enabled by `BROKER_HOST_ADDR` (wired in the dot1x-bench compose). Several steps are
+**BENCH-VERIFY** against your step / step-ca version — notably the SSH host
+principal **authorisation policy**. See `serving/enrol-broker/` (host.go, sshsigner.go).
+
+## Bench checklist (BENCH-VERIFY)
+
+- Broker host plane: `step ssh certificate --host --sign …` (sshsigner.go) succeeds
+  against the CA's SSH host CA; the exact flags are the tunable part of the contract.
+- Host principal policy: requested principals are authorised (tighten the broker to
+  validate `principals` against the peer cert).
+- SELinux: the (root) service writing `/etc/ssh/*` and running `systemctl reload
+  sshd` under confinement — may need a small local TE module (à la the chrony
+  read module). Watch for AVCs.
+- Client: `ssh <host>` shows no host-key warning once `@cert-authority` is set.

files/ssh-hostcert/go.mod

@@ -0,0 +1,14 @@
+// fleet-ssh-hostcert — boot-time SSH host-certificate client (post-switch-root).
+// Gets the host's per-boot ephemeral SSH host key signed by the fleet SSH CA via
+// the enrol-broker host plane, authenticating with the TPM identity over mTLS —
+// so admins trust every host via one `@cert-authority` line instead of per-boot
+// TOFU (closes F-02 / POA&M P-17). Pure Go (go-tpm, no CGO), one static
+// reproducible binary like fleet-enrol/fleet-agent; deps pinned by go.sum.
+// See docs/ssh-host-certificate-design.md and files/ssh-hostcert/README.md.
+module fleet-ssh-hostcert
+
+go 1.26
+
+require github.com/google/go-tpm v0.9.8
+
+require golang.org/x/sys v0.8.0 // indirect

files/ssh-hostcert/go.sum

@@ -0,0 +1,6 @@
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

files/ssh-hostcert/http.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// brokerClient builds an HTTPS client that presents the host's TPM-backed mTLS
+// identity to the enrol-broker's host plane and verifies the broker's server cert
+// against the fleet CA. serverName for hostname verification is taken from the
+// broker URL's host.
+func brokerClient(id *tpmIdentity, brokerURL, caFile string) (*http.Client, error) {
+	u, err := url.Parse(brokerURL)
+	if err != nil {
+		return nil, fmt.Errorf("parse broker URL %q: %w", brokerURL, err)
+	}
+	if u.Scheme != "https" {
+		return nil, fmt.Errorf("broker URL must be https (mTLS), got %q", u.Scheme)
+	}
+	tlsCfg, err := mtlsClientConfig(id, caFile, u.Hostname())
+	if err != nil {
+		return nil, err
+	}
+	tr := &http.Transport{TLSClientConfig: tlsCfg}
+	return &http.Client{Timeout: 30 * time.Second, Transport: tr}, nil
+}

files/ssh-hostcert/identity.go

@@ -0,0 +1,93 @@
+// identity.go — the host's mTLS identity, reused from the TPM (same key/cert as
+// 802.1X, the NVMe hostnqn and the agent). The private key never leaves the TPM:
+// we present the enrolment cert (DER read from NV 0x01800100) as the leaf and
+// hand crypto/tls a crypto.Signer backed by the persistent key at 0x81000100
+// (tpmkey.LoadSigner). The enrol-broker's host plane verifies this chain to the
+// fleet CA (RequireAndVerifyClientCert) — proving "an enrolled fleet host" — and
+// only then signs the SSH host cert. Mirrors files/agent/identity.go.
+package main
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"os"
+
+	"fleet-ssh-hostcert/tpmkey"
+
+	"github.com/google/go-tpm/tpm2"
+	"github.com/google/go-tpm/tpm2/transport"
+)
+
+// tpmIdentity holds the open TPM transport plus the loaded mTLS identity so the
+// caller can close the device when done.
+type tpmIdentity struct {
+	dev  *os.File
+	cert tls.Certificate
+}
+
+func (id *tpmIdentity) Close() error {
+	if id != nil && id.dev != nil {
+		return id.dev.Close()
+	}
+	return nil
+}
+
+// loadTPMIdentity opens the TPM, loads the signing key at handle, reads the cert
+// from NV index, and assembles a tls.Certificate whose PrivateKey is the TPM
+// signer. A missing key/cert means the host isn't enrolled yet — surfaced with a
+// clear error so the caller can fail-open (retry later, leave sshd untouched).
+func loadTPMIdentity(tpmPath string, handle, nvIndex tpm2.TPMHandle) (*tpmIdentity, error) {
+	// transport.FromReadWriter over the /dev/tpmrm0 *os.File avoids the linuxtpm
+	// transport and its extra deps — the same lean approach fleet-enrol/agent use.
+	f, err := os.OpenFile(tpmPath, os.O_RDWR, 0)
+	if err != nil {
+		return nil, fmt.Errorf("open TPM %s: %w", tpmPath, err)
+	}
+	tpm := transport.FromReadWriter(f)
+
+	signer, err := tpmkey.LoadSigner(tpm, handle)
+	if err != nil {
+		f.Close()
+		return nil, fmt.Errorf("load signing key at %#x: %w (host enrolled?)", uint32(handle), err)
+	}
+	der, err := tpmkey.ReadNVCert(tpm, nvIndex)
+	if err != nil {
+		f.Close()
+		return nil, fmt.Errorf("read identity cert from NV %#x: %w (host enrolled?)", uint32(nvIndex), err)
+	}
+	leaf, err := x509.ParseCertificate(der)
+	if err != nil {
+		f.Close()
+		return nil, fmt.Errorf("parse identity cert: %w", err)
+	}
+
+	return &tpmIdentity{
+		dev: f,
+		cert: tls.Certificate{
+			Certificate: [][]byte{der},
+			PrivateKey:  signer, // crypto.Signer — TLS signs the handshake in the TPM
+			Leaf:        leaf,
+		},
+	}, nil
+}
+
+// mtlsClientConfig builds the mTLS config: our TPM-backed client cert + the fleet
+// CA as the root that verifies the broker's server cert. serverName is the
+// broker's DNS name (SNI + hostname verification).
+func mtlsClientConfig(id *tpmIdentity, caFile, serverName string) (*tls.Config, error) {
+	pemBytes, err := os.ReadFile(caFile)
+	if err != nil {
+		return nil, fmt.Errorf("read fleet CA %s: %w", caFile, err)
+	}
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM(pemBytes) {
+		return nil, fmt.Errorf("no certificates parsed from fleet CA %s", caFile)
+	}
+	return &tls.Config{
+		MinVersion:   tls.VersionTLS12,
+		Certificates: []tls.Certificate{id.cert},
+		RootCAs:      pool,
+		ServerName:   serverName,
+	}, nil
+}

files/ssh-hostcert/main.go

@@ -0,0 +1,207 @@
+// Command fleet-ssh-hostcert obtains a fleet-CA-signed SSH *host* certificate for
+// this host's per-boot SSH host key and installs it, so administrators trust the
+// host via a single `@cert-authority` line instead of trust-on-first-use on a key
+// that changes every boot (the ephemeral RAM overlay regenerates host keys each
+// boot — see scripts/extract-artifacts.sh). Closes F-02 / POA&M P-17.
+//
+// Flow (Design A, broker-mediated — docs/ssh-host-certificate-design.md):
+//  1. load the host's mTLS identity from the TPM (persistent key 0x81000100 +
+//     leaf cert in NV 0x01800100) — the same identity used for 802.1X, the NVMe
+//     hostnqn and agent mTLS. The private key never leaves the TPM.
+//  2. read the freshly generated public host key (/etc/ssh/ssh_host_ecdsa_key.pub).
+//  3. POST it to the enrol-broker's host plane over mTLS. The broker verifies the
+//     client cert to the fleet CA (proving an enrolled host) and has step-ca sign
+//     an SSH host certificate — the broker, not the host, holds the CA provisioner
+//     credential, keeping step-ca behind the single front door.
+//  4. write the returned cert + a HostCertificate sshd drop-in, then reload sshd.
+//
+// FAIL-OPEN: any failure (no network, broker/CA down, host not enrolled) exits
+// non-zero WITHOUT touching sshd — the host keeps serving its bare per-boot key
+// (today's behaviour). It never installs a missing/broken HostCertificate that
+// would stop sshd from starting. A systemd timer retries. Fleet-generic: no
+// per-host data in the image (invariant #1).
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"github.com/google/go-tpm/tpm2"
+)
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix("fleet-ssh-hostcert: ")
+
+	var (
+		tpmPath    = flag.String("tpm", envOr("SSH_HOSTCERT_TPM", "/dev/tpmrm0"), "TPM resource-manager device")
+		handleStr  = flag.String("handle", envOr("SSH_HOSTCERT_HANDLE", "0x81000100"), "persistent handle of the TPM identity key")
+		nvindexStr = flag.String("nvindex", envOr("SSH_HOSTCERT_NVINDEX", "0x01800100"), "NV index of the identity cert (DER)")
+		brokerURL  = flag.String("broker-url", envOr("SSH_HOSTCERT_BROKER_URL", "https://boot.fleet.lab:9444/ssh/hostcert"), "enrol-broker host-plane SSH host-cert endpoint (mTLS)")
+		caFile     = flag.String("cacert", envOr("SSH_HOSTCERT_CACERT", "/etc/dot1x/radius-ca.pem"), "fleet CA bundle (verifies the broker's server cert)")
+		hostKey    = flag.String("hostkey", envOr("SSH_HOSTCERT_HOSTKEY", "/etc/ssh/ssh_host_ecdsa_key.pub"), "SSH host public key to certify")
+		outCert    = flag.String("out", envOr("SSH_HOSTCERT_OUT", "/etc/ssh/ssh_host_ecdsa_key-cert.pub"), "path to write the host certificate")
+		dropIn     = flag.String("dropin", envOr("SSH_HOSTCERT_DROPIN", "/etc/ssh/sshd_config.d/60-hostcert.conf"), "sshd drop-in that references the host certificate")
+		principals = flag.String("principals", envOr("SSH_HOSTCERT_PRINCIPALS", ""), "comma-separated cert principals (default: hostname)")
+		reload     = flag.Bool("reload", envOr("SSH_HOSTCERT_RELOAD", "true") == "true", "reload sshd after installing the certificate")
+	)
+	flag.Parse()
+
+	handle, err := parseHandle(*handleStr)
+	if err != nil {
+		log.Fatalf("bad -handle: %v", err)
+	}
+	nvindex, err := parseHandle(*nvindexStr)
+	if err != nil {
+		log.Fatalf("bad -nvindex: %v", err)
+	}
+
+	// --- mTLS identity from the TPM ------------------------------------------
+	id, err := loadTPMIdentity(*tpmPath, handle, nvindex)
+	if err != nil {
+		log.Fatalf("TPM identity: %v", err)
+	}
+	defer id.Close()
+
+	// --- request inputs -------------------------------------------------------
+	pubLine, err := readHostPubLine(*hostKey)
+	if err != nil {
+		log.Fatalf("read host key %s: %v", *hostKey, err)
+	}
+	princ := splitPrincipals(*principals)
+	if len(princ) == 0 {
+		princ = defaultPrincipals()
+	}
+	keyID := ""
+	if id.cert.Leaf != nil {
+		keyID = id.cert.Leaf.Subject.CommonName
+	}
+	if keyID == "" {
+		keyID = princ[0]
+	}
+
+	// --- ask the broker to sign (over mTLS) ----------------------------------
+	client, err := brokerClient(id, *brokerURL, *caFile)
+	if err != nil {
+		log.Fatalf("broker client: %v", err)
+	}
+	certLine, err := requestHostCert(client, *brokerURL, pubLine, princ, keyID)
+	if err != nil {
+		log.Fatalf("request SSH host cert: %v", err)
+	}
+
+	// --- install (only now do we touch sshd's config surface) -----------------
+	if err := writeFileAtomic(*outCert, []byte(strings.TrimRight(certLine, "\n")+"\n"), 0o644); err != nil {
+		log.Fatalf("write cert %s: %v", *outCert, err)
+	}
+	dropContent := fmt.Sprintf("# Managed by fleet-ssh-hostcert. Host cert signed by the fleet SSH CA.\nHostCertificate %s\n", *outCert)
+	if err := writeFileAtomic(*dropIn, []byte(dropContent), 0o644); err != nil {
+		log.Fatalf("write drop-in %s: %v", *dropIn, err)
+	}
+	log.Printf("installed SSH host certificate for principals %v (keyID %q)", princ, keyID)
+
+	if *reload {
+		if out, err := exec.Command("systemctl", "reload", "sshd.service").CombinedOutput(); err != nil {
+			// Non-fatal: the cert is on disk and takes effect on the next sshd (re)start.
+			log.Printf("warning: sshd reload failed (%v): %s", err, strings.TrimSpace(string(out)))
+		}
+	}
+}
+
+type hostCertRequest struct {
+	PublicKey  string   `json:"publicKey"`
+	Principals []string `json:"principals"`
+	KeyID      string   `json:"keyID"`
+}
+
+type hostCertResponse struct {
+	Cert  string `json:"cert"`
+	Error string `json:"error,omitempty"`
+}
+
+// requestHostCert POSTs the host public key to the broker's mTLS host plane and
+// returns the signed SSH host-certificate line (`ecdsa-sha2-…-cert-v01@… AAAA…`).
+func requestHostCert(client *http.Client, url, pubLine string, principals []string, keyID string) (string, error) {
+	body, err := json.Marshal(hostCertRequest{PublicKey: pubLine, Principals: principals, KeyID: keyID})
+	if err != nil {
+		return "", err
+	}
+	resp, err := client.Post(url, "application/json", bytes.NewReader(body))
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode/100 != 2 {
+		return "", fmt.Errorf("broker %s: %s", resp.Status, strings.TrimSpace(string(raw)))
+	}
+	var out hostCertResponse
+	if err := json.Unmarshal(raw, &out); err != nil || out.Cert == "" {
+		return "", fmt.Errorf("unexpected broker response: %s", strings.TrimSpace(string(raw)))
+	}
+	return out.Cert, nil
+}
+
+// readHostPubLine returns the trimmed single-line OpenSSH public key (type +
+// base64 + optional comment) that the broker signs.
+func readHostPubLine(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	line := strings.TrimSpace(string(b))
+	if len(strings.Fields(line)) < 2 {
+		return "", fmt.Errorf("malformed public key (want at least 2 fields)")
+	}
+	return line, nil
+}
+
+func splitPrincipals(s string) []string {
+	var out []string
+	for p := range strings.SplitSeq(s, ",") {
+		if p = strings.TrimSpace(p); p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func defaultPrincipals() []string {
+	h, err := os.Hostname()
+	if err != nil || h == "" {
+		return []string{"localhost"}
+	}
+	return []string{h}
+}
+
+func envOr(k, def string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return def
+}
+
+func parseHandle(s string) (tpm2.TPMHandle, error) {
+	v, err := strconv.ParseUint(strings.TrimPrefix(strings.ToLower(s), "0x"), 16, 32)
+	if err != nil {
+		return 0, err
+	}
+	return tpm2.TPMHandle(v), nil
+}
+
+func writeFileAtomic(path string, data []byte, mode os.FileMode) error {
+	tmp := path + ".tmp"
+	if err := os.WriteFile(tmp, data, mode); err != nil {
+		return err
+	}
+	return os.Rename(tmp, path)
+}

files/ssh-hostcert/main_test.go

@@ -0,0 +1,91 @@
+package main
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestReadHostPubLine(t *testing.T) {
+	dir := t.TempDir()
+	p := dir + "/k.pub"
+	if err := writeFileAtomic(p, []byte("ecdsa-sha2-nistp256 AAAAB3Nz root@fleet\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	line, err := readHostPubLine(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if line != "ecdsa-sha2-nistp256 AAAAB3Nz root@fleet" {
+		t.Errorf("got %q", line)
+	}
+	if err := writeFileAtomic(p, []byte("garbage\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readHostPubLine(p); err == nil {
+		t.Error("expected error on malformed key")
+	}
+}
+
+func TestSplitPrincipals(t *testing.T) {
+	got := splitPrincipals(" a, b ,,c ")
+	if len(got) != 3 || got[0] != "a" || got[1] != "b" || got[2] != "c" {
+		t.Errorf("got %v", got)
+	}
+	if len(splitPrincipals("")) != 0 {
+		t.Error("empty string should yield no principals")
+	}
+}
+
+func TestParseHandle(t *testing.T) {
+	h, err := parseHandle("0x81000100")
+	if err != nil || uint32(h) != 0x81000100 {
+		t.Fatalf("h=%#x err=%v", uint32(h), err)
+	}
+	if _, err := parseHandle("nothex"); err == nil {
+		t.Error("expected error")
+	}
+}
+
+func TestRequestHostCert(t *testing.T) {
+	const certLine = "ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAcert host.fleet.lab"
+	var gotReq hostCertRequest
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer r.Body.Close()
+		raw, _ := io.ReadAll(r.Body)
+		_ = json.Unmarshal(raw, &gotReq)
+		writeJSON(w, http.StatusOK, hostCertResponse{Cert: certLine})
+	}))
+	defer srv.Close()
+
+	got, err := requestHostCert(srv.Client(), srv.URL, "ecdsa-sha2-nistp256 AAAA host", []string{"host", "host.fleet.lab"}, "host.fleet.lab")
+	if err != nil {
+		t.Fatalf("requestHostCert: %v", err)
+	}
+	if got != certLine {
+		t.Errorf("cert = %q", got)
+	}
+	if gotReq.PublicKey != "ecdsa-sha2-nistp256 AAAA host" || gotReq.KeyID != "host.fleet.lab" || len(gotReq.Principals) != 2 {
+		t.Errorf("broker received unexpected request: %+v", gotReq)
+	}
+}
+
+func TestRequestHostCertErrorBody(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		writeJSON(w, http.StatusForbidden, hostCertResponse{Error: "not enrolled"})
+	}))
+	defer srv.Close()
+	if _, err := requestHostCert(srv.Client(), srv.URL, "ecdsa-sha2-nistp256 AAAA host", []string{"host"}, "host"); err == nil || !strings.Contains(err.Error(), "not enrolled") {
+		t.Errorf("want error carrying broker message, got %v", err)
+	}
+}
+
+// writeJSON mirrors the broker's small JSON helper for the test server.
+func writeJSON(w http.ResponseWriter, code int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	_ = json.NewEncoder(w).Encode(v)
+}

files/ssh-hostcert/ssh-hostcert.env

@@ -0,0 +1,33 @@
+# fleet-ssh-hostcert configuration — fleet-generic (no per-host data; invariant #1).
+# The host's SSH host key is signed by the fleet SSH CA (via the enrol-broker) so
+# admins trust every host with one `@cert-authority` line instead of per-boot TOFU
+# (F-02/P-17). Replace the DNS names per environment; the serving dnsmasq resolves
+# them. docs/ssh-host-certificate-design.md.
+
+# The enrol-broker's HOST PLANE endpoint (mTLS). The host authenticates with its
+# TPM identity; the broker (not the host) holds the step-ca provisioner credential
+# and signs the SSH host cert, keeping step-ca behind the single front door.
+SSH_HOSTCERT_BROKER_URL=https://boot.fleet.lab:9444/ssh/hostcert
+
+# Fleet CA bundle: verifies the broker's server cert. Same anchor as the RADIUS /
+# agent CA — reuse the one placeholder, replace per environment.
+SSH_HOSTCERT_CACERT=/etc/dot1x/radius-ca.pem
+
+# TPM identity (same key/cert as 802.1X, the NVMe hostnqn and agent mTLS) — used
+# as the mTLS CLIENT cert proving this is an enrolled host.
+SSH_HOSTCERT_HANDLE=0x81000100
+SSH_HOSTCERT_NVINDEX=0x01800100
+
+# The per-boot host key to certify and where its certificate is installed.
+SSH_HOSTCERT_HOSTKEY=/etc/ssh/ssh_host_ecdsa_key.pub
+SSH_HOSTCERT_OUT=/etc/ssh/ssh_host_ecdsa_key-cert.pub
+SSH_HOSTCERT_DROPIN=/etc/ssh/sshd_config.d/60-hostcert.conf
+
+# Cert principals. Empty => the binary uses the host's hostname (derived at
+# runtime, never baked). Set a comma list to add e.g. a per-env FQDN or wildcard
+# that admins connect by (must be covered by their `@cert-authority` line and
+# authorised by the broker's principal policy).
+SSH_HOSTCERT_PRINCIPALS=
+
+# Reload sshd after installing/renewing the cert so it takes effect immediately.
+SSH_HOSTCERT_RELOAD=true

files/ssh-hostcert/ssh-hostcert.service

@@ -0,0 +1,51 @@
+[Unit]
+Description=Fleet SSH host-certificate acquisition (TPM-authenticated, fleet SSH CA)
+Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/docs/ssh-host-certificate-design.md
+# Needs the network up (dials step-ca) and sshd's per-boot host key to exist.
+# sshd-keygen generates the host key before sshd starts, so ordering After sshd
+# guarantees the key is present; sshd itself serves the bare key until we install
+# the cert and reload it. All soft ordering (After, not Requires) — this unit is
+# FAIL-OPEN: if the CA is unreachable or the host isn't enrolled yet, it exits
+# non-zero WITHOUT touching sshd, and the timer retries.
+After=network-online.target sshd.service
+Wants=network-online.target
+# Don't run in the throwaway build VM (no TPM, no enrolment, no network CA).
+ConditionPathExists=/dev/tpmrm0
+
+[Service]
+Type=oneshot
+EnvironmentFile=/etc/ssh-hostcert/ssh-hostcert.env
+ExecStart=/usr/local/bin/fleet-ssh-hostcert
+
+# Runs as root — unlike the DynamicUser agent — because it writes root-owned
+# files under /etc/ssh and reloads sshd. Kept tightly sandboxed otherwise. The
+# TPM private key never leaves the chip; root only drives signing through it.
+User=root
+# STIG-friendly sandbox. /etc/ssh must be writable (the cert + drop-in); the rest
+# of the filesystem is read-only.
+ProtectSystem=strict
+ReadWritePaths=/etc/ssh
+ProtectHome=yes
+PrivateTmp=yes
+DeviceAllow=/dev/tpmrm0 rw
+NoNewPrivileges=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+# INET egress to step-ca; AF_UNIX for the journal + talking to systemd (reload
+# sshd); AF_NETLINK for Go's interface/source-address selection.
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+UMask=0022
+
+# Triggered by ssh-hostcert.timer (boot + periodic renewal), not enabled directly.

files/ssh-hostcert/ssh-hostcert.timer

@@ -0,0 +1,17 @@
+[Unit]
+Description=Renew the fleet SSH host certificate
+Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/docs/ssh-host-certificate-design.md
+
+[Timer]
+# Fire shortly after boot (once the network + enrolment are likely ready) to
+# acquire the first cert for this boot's ephemeral host key, then renew well
+# inside the cert's validity window. The service is idempotent + fail-open, so a
+# missed/failed run just retries next cycle (sshd keeps serving the bare key
+# meanwhile). Cadence is bench-tunable (host-cert validity is a step-ca policy).
+OnBootSec=60s
+OnUnitActiveSec=1h
+Persistent=false
+AccuracySec=15s
+
+[Install]
+WantedBy=timers.target

files/ssh-hostcert/tpmkey/tpmkey.go

@@ -0,0 +1,304 @@
+// Package tpmkey — TPM 2.0 operations via go-tpm (pure Go, no CGO, no tpm2-tools
+// / no openssl tpm2 provider). Provides: ensure a persistent ECDSA signing key
+// at a non-reserved owner handle (default 0x81000100 — NOT the EK slot
+// 0x81010001, see EnsureKey), a crypto.Signer backed by it (for CSR signing),
+// and NV cert read-presence + write at 0x01800100. Talks to any transport.TPM,
+// so the same
+// code runs against /dev/tpmrm0 (production) and the software simulator (tests).
+//
+// Exported so the ceremony can be tested against the go-tpm simulator from a
+// SEPARATE module (simtest/), keeping this module's vendored deps lean (go-tpm
+// only) — the simulator (CGO + the MS TPM reference C) never enters the image build.
+//
+// NOTE: this is a COPY of files/enrol/tpmkey (via files/agent/tpmkey) — kept
+// byte-identical apart from the added read-only LoadSigner — so every reused-
+// identity client (agent, ssh-hostcert) has the exact same, bench-verified TPM
+// signing path without importing across the load-bearing fleet-enrol module.
+// ssh-hostcert only READS the key (LoadSigner) + NV cert (ReadNVCert); it never
+// creates/evicts. A future refactor could promote tpmkey to a shared module.
+package tpmkey
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"encoding/asn1"
+	"fmt"
+	"io"
+	"math/big"
+
+	"github.com/google/go-tpm/tpm2"
+	"github.com/google/go-tpm/tpm2/transport"
+)
+
+// eccSigningTemplate: a NON-restricted ECC P-256 ECDSA-SHA256 signing key.
+// Non-restricted so it can sign an externally-computed digest (the CSR TBS) with
+// a NULL validation ticket; Symmetric/KDF are explicitly NULL (sign-only key).
+func eccSigningTemplate() tpm2.TPMTPublic {
+	return tpm2.TPMTPublic{
+		Type:    tpm2.TPMAlgECC,
+		NameAlg: tpm2.TPMAlgSHA256,
+		ObjectAttributes: tpm2.TPMAObject{
+			FixedTPM:            true,
+			FixedParent:         true,
+			SensitiveDataOrigin: true,
+			UserWithAuth:        true,
+			SignEncrypt:         true,
+			NoDA:                true,
+		},
+		Parameters: tpm2.NewTPMUPublicParms(tpm2.TPMAlgECC, &tpm2.TPMSECCParms{
+			Symmetric: tpm2.TPMTSymDefObject{Algorithm: tpm2.TPMAlgNull},
+			Scheme: tpm2.TPMTECCScheme{
+				Scheme: tpm2.TPMAlgECDSA,
+				Details: tpm2.NewTPMUAsymScheme(tpm2.TPMAlgECDSA, &tpm2.TPMSSigSchemeECDSA{
+					HashAlg: tpm2.TPMAlgSHA256,
+				}),
+			},
+			CurveID: tpm2.TPMECCNistP256,
+			KDF:     tpm2.TPMTKDFScheme{Scheme: tpm2.TPMAlgNull},
+		}),
+	}
+}
+
+// Signer implements crypto.Signer using a persistent TPM key.
+type Signer struct {
+	tpm    transport.TPM
+	handle tpm2.TPMHandle
+	name   tpm2.TPM2BName
+	pub    *ecdsa.PublicKey
+}
+
+func (s *Signer) Public() crypto.PublicKey { return s.pub }
+
+func (s *Signer) Sign(_ io.Reader, digest []byte, _ crypto.SignerOpts) ([]byte, error) {
+	rsp, err := tpm2.Sign{
+		KeyHandle: tpm2.NamedHandle{Handle: s.handle, Name: s.name},
+		Digest:    tpm2.TPM2BDigest{Buffer: digest},
+		InScheme: tpm2.TPMTSigScheme{
+			Scheme: tpm2.TPMAlgECDSA,
+			Details: tpm2.NewTPMUSigScheme(tpm2.TPMAlgECDSA, &tpm2.TPMSSchemeHash{
+				HashAlg: tpm2.TPMAlgSHA256,
+			}),
+		},
+		Validation: tpm2.TPMTTKHashCheck{Tag: tpm2.TPMSTHashCheck},
+	}.Execute(s.tpm)
+	if err != nil {
+		return nil, fmt.Errorf("tpm sign: %w", err)
+	}
+	ecc, err := rsp.Signature.Signature.ECDSA()
+	if err != nil {
+		return nil, fmt.Errorf("tpm sign: not ECDSA: %w", err)
+	}
+	r := new(big.Int).SetBytes(ecc.SignatureR.Buffer)
+	sInt := new(big.Int).SetBytes(ecc.SignatureS.Buffer)
+	// x509 expects an ASN.1 DER ECDSA-Sig-Value{ r, s }.
+	return asn1.Marshal(struct{ R, S *big.Int }{r, sInt})
+}
+
+func signerFromPub(tpm transport.TPM, handle tpm2.TPMHandle, name tpm2.TPM2BName, pub2b tpm2.TPM2BPublic) (*Signer, error) {
+	pub, err := pub2b.Contents()
+	if err != nil {
+		return nil, err
+	}
+	det, err := pub.Parameters.ECCDetail()
+	if err != nil {
+		return nil, fmt.Errorf("key at handle is not ECC: %w", err)
+	}
+	uniq, err := pub.Unique.ECC()
+	if err != nil {
+		return nil, err
+	}
+	pk, err := tpm2.ECDSAPub(det, uniq)
+	if err != nil {
+		return nil, err
+	}
+	return &Signer{tpm: tpm, handle: handle, name: name, pub: pk}, nil
+}
+
+// isProtectedObject reports whether a persistent object is a restricted
+// decryption key — i.e. an Endorsement Key or Storage Root Key. We must NEVER
+// evict one of those (it would destroy the TPM's endorsement/storage identity,
+// including the EK the future EK/AK attestation path depends on). Fail-safe: if
+// the public area can't be parsed, treat it as protected.
+func isProtectedObject(pub2b tpm2.TPM2BPublic) bool {
+	pub, err := pub2b.Contents()
+	if err != nil {
+		return true
+	}
+	a := pub.ObjectAttributes
+	return a.Restricted && a.Decrypt
+}
+
+// ensureKey returns a signer for the persistent key at handle, creating +
+// persisting a fresh ECDSA key there if none exists. Returns created=true when
+// a new key was generated. handle MUST be a non-reserved owner handle (the fleet
+// default is 0x81000100) — NOT the EK (0x81010001/2) or SRK (0x81000001/2) slots.
+//
+// If the handle already holds an object that is NOT our ECC signing key (e.g. an
+// RSA signing key left by an older tpm2-tools/openssl provisioning path — go-tpm
+// reports "key at handle is not ECC"), it is treated as STALE and evicted, then a
+// fresh ECC key is created. Safe on the enrol path: this only runs on an empty-NV
+// host, so no issued cert references the old key. Only a valid ECC key is reused.
+// A restricted-decrypt object (EK/SRK) is NEVER evicted — it errors instead, which
+// only happens if handle was misconfigured to a reserved slot.
+func EnsureKey(tpm transport.TPM, handle tpm2.TPMHandle) (signer *Signer, created bool, err error) {
+	if rp, e := (tpm2.ReadPublic{ObjectHandle: handle}).Execute(tpm); e == nil {
+		// Guard FIRST: never touch a restricted-decrypt object (EK/SRK). An ECC
+		// EK/SRK would otherwise parse as a usable ECC key below and be "reused".
+		if isProtectedObject(rp.OutPublic) {
+			return nil, false, fmt.Errorf("refusing to evict a restricted-decrypt object (EK/SRK?) at handle %#x — configure a non-reserved owner handle (e.g. 0x81000100)", uint32(handle))
+		}
+		if s, e2 := signerFromPub(tpm, handle, rp.Name, rp.OutPublic); e2 == nil {
+			return s, false, nil // our ECC signing key is already there — reuse it
+		}
+		// Stale/wrong-type signing key occupying the handle — evict so we recreate.
+		if _, e2 := (tpm2.EvictControl{
+			Auth:             tpm2.TPMRHOwner,
+			ObjectHandle:     &tpm2.NamedHandle{Handle: handle, Name: rp.Name},
+			PersistentHandle: handle,
+		}).Execute(tpm); e2 != nil {
+			return nil, false, fmt.Errorf("evict stale (non-ECC) key at handle: %w", e2)
+		}
+	}
+
+	cp, err := tpm2.CreatePrimary{
+		PrimaryHandle: tpm2.TPMRHOwner,
+		InPublic:      tpm2.New2B(eccSigningTemplate()),
+	}.Execute(tpm)
+	if err != nil {
+		return nil, false, fmt.Errorf("createprimary: %w", err)
+	}
+	// Persist at the well-known handle, then flush the transient object.
+	_, err = tpm2.EvictControl{
+		Auth:             tpm2.TPMRHOwner,
+		ObjectHandle:     &tpm2.NamedHandle{Handle: cp.ObjectHandle, Name: cp.Name},
+		PersistentHandle: handle,
+	}.Execute(tpm)
+	_, _ = (tpm2.FlushContext{FlushHandle: cp.ObjectHandle}).Execute(tpm)
+	if err != nil {
+		return nil, false, fmt.Errorf("evictcontrol: %w", err)
+	}
+	rp, err := (tpm2.ReadPublic{ObjectHandle: handle}).Execute(tpm)
+	if err != nil {
+		return nil, false, fmt.Errorf("readpublic after persist: %w", err)
+	}
+	s, err := signerFromPub(tpm, handle, rp.Name, rp.OutPublic)
+	return s, true, err
+}
+
+// LoadSigner returns a crypto.Signer for the persistent key ALREADY at handle,
+// WITHOUT creating one. This is the reused-identity path (normal boot / the on-host
+// agent): the fleet signing key was created at enrolment, so here we only sign the
+// TLS handshake with it — the private key never leaves the TPM. Errors (never
+// creates/evicts) if the handle is empty, holds a non-ECC object, or holds a
+// restricted-decrypt EK/SRK. Contrast EnsureKey, which is the enrol-time create path.
+func LoadSigner(tpm transport.TPM, handle tpm2.TPMHandle) (*Signer, error) {
+	rp, err := (tpm2.ReadPublic{ObjectHandle: handle}).Execute(tpm)
+	if err != nil {
+		return nil, fmt.Errorf("no persistent key at handle %#x: %w", uint32(handle), err)
+	}
+	if isProtectedObject(rp.OutPublic) {
+		return nil, fmt.Errorf("object at handle %#x is a restricted-decrypt key (EK/SRK?), not the fleet signing key", uint32(handle))
+	}
+	return signerFromPub(tpm, handle, rp.Name, rp.OutPublic)
+}
+
+// nvPresent reports whether a defined NV index exists. NOTE: "defined" does NOT
+// mean "holds our fleet cert" — leftover/foreign NV (e.g. an earlier
+// tpm-provision run, or another OS) also reports present. Prefer ReadNVCert +
+// content validation for the enrol decision; this stays for cheap existence checks.
+func NVPresent(tpm transport.TPM, index tpm2.TPMHandle) bool {
+	_, err := (tpm2.NVReadPublic{NVIndex: index}).Execute(tpm)
+	return err == nil
+}
+
+// ReadNVCert reads the full contents of NV index (chunked under the NV buffer
+// limit). Returns an error if the index is undefined or unreadable — callers
+// treat that as "no cert" (enrol). The bytes are the caller's to parse/validate;
+// this does not assume they are a certificate.
+func ReadNVCert(tpm transport.TPM, index tpm2.TPMHandle) ([]byte, error) {
+	rp, err := (tpm2.NVReadPublic{NVIndex: index}).Execute(tpm)
+	if err != nil {
+		return nil, fmt.Errorf("nv readpublic: %w", err)
+	}
+	pub, err := rp.NVPublic.Contents()
+	if err != nil {
+		return nil, err
+	}
+	size := int(pub.DataSize)
+	out := make([]byte, 0, size)
+	const chunk = 512 // conservatively under TPM_MAX_NV_BUFFER_SIZE
+	for off := 0; off < size; off += chunk {
+		end := min(off+chunk, size)
+		r, err := (tpm2.NVRead{
+			AuthHandle: tpm2.AuthHandle{Handle: index, Name: rp.NVName, Auth: tpm2.PasswordAuth(nil)},
+			NVIndex:    tpm2.NamedHandle{Handle: index, Name: rp.NVName},
+			Size:       uint16(end - off),
+			Offset:     uint16(off),
+		}).Execute(tpm)
+		if err != nil {
+			return nil, fmt.Errorf("nv read @%d: %w", off, err)
+		}
+		out = append(out, r.Data.Buffer...)
+	}
+	return out, nil
+}
+
+// nvWriteCert (re)defines the NV index sized to der and writes it under owner
+// auth. Chunks the write to stay within the TPM's NV buffer limit.
+func WriteNVCert(tpm transport.TPM, index tpm2.TPMHandle, der []byte) error {
+	// Undefine a stale index first (re-enrolment / resized cert).
+	if rp, err := (tpm2.NVReadPublic{NVIndex: index}).Execute(tpm); err == nil {
+		// A PLATFORM-created index at our handle is OEM firmware NV (bench-seen on
+		// a Dell 820: 0x01800001 was platformcreate|policydelete|writelocked). We
+		// cannot undefine it with owner auth, and TPM2_Clear/BIOS won't remove it —
+		// so fail LOUDLY with guidance rather than a confusing "nv undefine" error.
+		// The remedy is a different, free owner index via rd.dot1x.nvindex.
+		if pub, e := rp.NVPublic.Contents(); e == nil && pub.Attributes.PlatformCreate {
+			return fmt.Errorf("NV index %#x is a platform-created (firmware-owned) index — cannot be written by enrolment; pick a free owner index via rd.dot1x.nvindex / -nvindex", uint32(index))
+		}
+		if _, err := (tpm2.NVUndefineSpace{
+			AuthHandle: tpm2.TPMRHOwner,
+			NVIndex:    tpm2.NamedHandle{Handle: index, Name: rp.NVName},
+		}).Execute(tpm); err != nil {
+			return fmt.Errorf("nv undefine: %w", err)
+		}
+	}
+
+	def := tpm2.NVDefineSpace{
+		AuthHandle: tpm2.TPMRHOwner,
+		PublicInfo: tpm2.New2B(tpm2.TPMSNVPublic{
+			NVIndex: index,
+			NameAlg: tpm2.TPMAlgSHA256,
+			Attributes: tpm2.TPMANV{
+				OwnerWrite: true,
+				OwnerRead:  true,
+				AuthWrite:  true,
+				AuthRead:   true,
+				NT:         tpm2.TPMNTOrdinary,
+				NoDA:       true,
+			},
+			DataSize: uint16(len(der)),
+		}),
+	}
+	if _, err := def.Execute(tpm); err != nil {
+		return fmt.Errorf("nv define: %w", err)
+	}
+	rp, err := (tpm2.NVReadPublic{NVIndex: index}).Execute(tpm)
+	if err != nil {
+		return fmt.Errorf("nv readpublic: %w", err)
+	}
+
+	const chunk = 512 // conservatively under TPM_MAX_NV_BUFFER_SIZE
+	for off := 0; off < len(der); off += chunk {
+		end := min(off+chunk, len(der))
+		if _, err := (tpm2.NVWrite{
+			AuthHandle: tpm2.AuthHandle{Handle: index, Name: rp.NVName, Auth: tpm2.PasswordAuth(nil)},
+			NVIndex:    tpm2.NamedHandle{Handle: index, Name: rp.NVName},
+			Data:       tpm2.TPM2BMaxNVBuffer{Buffer: der[off:end]},
+			Offset:     uint16(off),
+		}).Execute(tpm); err != nil {
+			return fmt.Errorf("nv write @%d: %w", off, err)
+		}
+	}
+	return nil
+}