Support Vault ssh certificate endpoints
**Is your feature request related to a problem? Please describe.** For example, I have a Vault ssh secret store mounted at `ssh/`. Users expect to submit their public key to `ssh/sign/name` and be returned a certificate signed by the certificate authority. The user can authenticate to over ssh using their private key and ca signed ssh certificate. I want to use Boundary as the the authentication mechanism and transit to hosts. We can configure the Vault ssh endpoint as a Boundary Credential Library, but there does not appear to be a way to pass the user's public key through to Boundary to be signed by Vault and returned. **Describe the solution you'd like** I'd like a solution were the user can pass a parameter of the public key to have signed, which would be passed through to the Vault ssh mount. For example, a user would run `boundary connect ssh -target-name=somehost -public_key=~/.ssh/id_ed25519.pub` and be returned a signed certificate. **Describe alternatives you've considered** Continue to expose Vault and bastions to end users instead of using Boundary.
Posted by eholzbach on Dec 7, 2021, 9:30 PM
Tags
Related issues
- some bike vendor told me that the biggest problem with regular to ebike conversion was that regular bike frames were not strong enough to...
- I think of this as the kiosk economy.
- What a goofy comment.
- There's lots of evidence for positive influences of Caffeine on the body (some negative as well), especially the brain.
- Compose support in WSLc
- [RFC] Roadmap to v2.0
Raise real-world problems, find people facing the same issue, and discuss solutions.3,000 issues0 comments
support (Other)
some bike vendor told me that the biggest problem with regular to ebike conversion was that regular bike frames were not strong enough to...
I think of this as the kiosk economy.
What a goofy comment.
There's lots of evidence for positive influences of Caffeine on the body (some negative as well), especially the brain.
Compose support in WSLc
[RFC] Roadmap to v2.0
[Feature]: Add TurboQuant Support for KV Cache Quantization
Support for AGENTS.md and .agents/skills/, the community has been asking since August 2025
Support Vault ssh certificate endpoints
**Is your feature request related to a problem? Please describe.** For example, I have a Vault ssh secret store mounted at `ssh/`. Users expect to submit their public key to `ssh/sign/name` and be returned a certificate signed by the certificate authority. The user can authenticate to over ssh using their private key and ca signed ssh certificate. I want to use Boundary as the the authentication mechanism and transit to hosts. We can configure the Vault ssh endpoint as a Boundary Credential Library, but there does not appear to be a way to pass the user's public key through to Boundary to be signed by Vault and returned. **Describe the solution you'd like** I'd like a solution were the user can pass a parameter of the public key to have signed, which would be passed through to the Vault ssh mount. For example, a user would run `boundary connect ssh -target-name=somehost -public_key=~/.ssh/id_ed25519.pub` and be returned a signed certificate. **Describe alternatives you've considered** Continue to expose Vault and bastions to end users instead of using Boundary.
Comments (0)
No comments yet. Start the discussion.