SSH certificate purge — cleanly undo a mis-issued certificate
A new purge operation hard-deletes an SSH certificate and every trace of it from the database — for the case of a certificate created by mistake that never left the server. It is distinct from revoke (which keeps the record and adds it to the KRL) and from host offboard (decommission).
A certificate is a signed credential that may exist in copies outside the database, and the KRL — which is derived from DB state — is the only thing that stops a still-valid copy. Purge is therefore KRL-safe by construction:
- active (never revoked) → pure purge: its serial was never in the KRL, so removal leaves zero trace and nothing to un-revoke.
- revoked + still valid → requires
force; by default the serial is preserved in the KRL (via a standalone directive) so it stays revoked until it expires. PassdropRevocationto also remove it from the KRL — which re-enables any copy still in the wild, so it is a deliberate, separately-flagged act. - expired → purged freely.
Every purge writes an ssh.cert.purge audit-log entry (serial, reason, operator, KRL effect).
APIs
- REST:
DELETE /api/v1/ssh/certs/:id?force=&dropRevocation=— each variant documented in OpenAPI/Swagger. - tRPC:
ssh.krl.purgeCert.
UI
- A per-certificate Purge action with a confirmation dialog whose help text adapts to the certificate's state (active / expired / revoked+valid, including the
dropRevocationopt-in). - Below-button hover hints explaining the certificate and host lifecycle actions (Issue, Disable, Revoke, Renew, Offboard, Purge).
Full Changelog: v3.11.0...v3.12.0