Connect with SSH

After a grant is active, use tenvyr ssh to prove possession of the enrolled key, obtain a short-lived certificate, verify it locally, and launch OpenSSH.

tenvyr ssh host.example.com \
  --host-group HOST_GROUP_UUID \
  --user deploy \
  --identity /path/to/private-key-or-hardware-key-handle \
  --credential CREDENTIAL_UUID \
  --grant GRANT_UUID \
  --ttl 10m

What the command does

1. Requests a one-use certificate proof challenge.
2. Signs the challenge with the selected SSH key.
3. Requests a certificate bound to the grant, host group, host, local account, and current host-key revision.
4. Verifies the returned certificate before writing a temporary file.
5. Launches the system OpenSSH client directly to the host.
6. Removes temporary certificate material after OpenSSH exits.

Host identity protection

Tenvyr binds certificate acquisition to the managed host identity and its reported host-key set. A host-key change that has not been reconciled fails closed instead of silently accepting a different machine.

Certificate lifetime

The requested TTL is limited by:

• the policy certificate lifetime;
• the remaining grant lifetime; and
• the product-wide ten-minute maximum.

Request a new certificate when the previous one expires. The grant may remain active longer than a single certificate.

Troubleshooting