A certificate authority that removes eleven authorized_keys files and creates one key that must not be lost.
the audit question: where is the CA key backed up?
answer, until December: in the same encrypted
backup as everything else, in the same object
store, under the same credential.
which means a compromise that reaches the backup
reaches the ability to sign a certificate for any
principal on any host.
now: offline, in the sealed envelope with the backup
decryption key, and not in any automated backup.Concentrating eleven files into one key is the point of a certificate authority and it concentrates the risk in the same motion. The key being in the backup that the key protects access to is a circularity that took eighteen months to notice, and the answer is that it is not backed up automatically at all.