adding `--expires-in` to `step ssh renew`

[logopk]

As @maraino suggested in #622 I would like to post this request to add a verification if renewal time has come for an ssh host certificate.

As of now renewal of the host cert via step ssh renew in an automation via cron or systemd can only be forced.
This may lead to an unnecessary high amount of (valid) ssh certs.

Thanks.

[michael-anselmi]

Hi @logopk - you can use step ssh needs-renewal to check if it's time for renewal:

/etc/systemd/system/cert-renewer@sshd.service.d/override.conf

[Service]
; `Environment=` overrides are applied per environment variable. This line does not
; affect any other variables set in the service template.
Environment=CERT_LOCATION=/etc/ssh/ssh_host_key-cert.pub \
            KEY_LOCATION=/etc/ssh/ssh_host_key

; ExecCondition checks if the certificate is ready for renewal,
; based on the exit status of the command.
; (In systemd <242, you can use ExecStartPre= here.)
ExecCondition=
ExecCondition=/usr/local/bin/step ssh needs-renewal ${CERT_LOCATION} --expires-in=${EXPIRES_IN}

; ExecStart renews the certificate, if ExecCondition was successful.
ExecStart=
ExecStart=/usr/local/bin/step ssh renew ${CERT_LOCATION} ${KEY_LOCATION} --force

; Try to reload or restart the systemd service that relies on this cert-renewer
; If the relying service doesn't exist, forge ahead.
; (In systemd <229, use `reload-or-try-restart` instead of `try-reload-or-restart`)
ExecStartPost=
ExecStartPost=/usr/bin/sh -c "! systemctl --quiet is-enabled %i.service || systemctl try-restart %i.service"

/etc/systemd/system/cert-renewer@.service

[Unit]
Description=Certificate renewer for %I
After=network-online.target
Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production
StartLimitIntervalSec=0

[Service]
Type=oneshot
User=root

Environment=STEPPATH=/etc/step-ca \
            CERT_LOCATION=/etc/step/certs/%i.crt \
            KEY_LOCATION=/etc/step/certs/%i.key \
            EXPIRES_IN=60%%

; ExecCondition checks if the certificate is ready for renewal,
; based on the exit status of the command.
; (In systemd <242, you can use ExecStartPre= here.)
ExecCondition=/usr/local/bin/step certificate needs-renewal ${CERT_LOCATION} --expires-in=${EXPIRES_IN}

; ExecStart renews the certificate, if ExecCondition was successful.
ExecStart=/usr/local/bin/step ca renew ${CERT_LOCATION} ${KEY_LOCATION} --force

; Try to reload or restart the systemd service that relies on this cert-renewer
; If the relying service doesn't exist, forge ahead.
; (In systemd <229, use `reload-or-try-restart` instead of `try-reload-or-restart`)
ExecStartPost=/usr/bin/sh -c "! systemctl --quiet is-enabled %i.service || systemctl try-reload-or-restart %i.service"

[Install]
WantedBy=multi-user.target

/etc/systemd/system/cert-renewer@.timer

[Unit]
Description=Certificate renewal timer for %I
Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production

[Timer]
Persistent=true

; Run the timer unit every 5 minutes.
OnCalendar=*-*-* *:01/5:00

; Always run the timer on time.
AccuracySec=1us

; Add jitter to prevent a "thundering hurd" of simultaneous certificate renewals.
RandomizedDelaySec=5m

[Install]
WantedBy=timers.target

[logopk]

@michael-anselmi
nice one! That of course works. Thank you. Still learning systemd...
Concatenated with && will also work on non systemd renewals.

So this is not an urgent issue anymore - but the parameters on x509 and ssh renewal could be synchronized.

[tashian]

@logopk I'm going to close this one out, but if you'd like to see those parameters synchronized between ssh and x.509 renewal (as much as they can be, that is), please open a separate issue for that. Thanks!

[tashian]

Whoops, I read the associated discussion context and I understand now that this issue is still relevant for synchronizing the params. Reopened.