Trust commands¶
Common global behavior is documented in the CLI hub. The complete CA command contracts follow.
rotate learn-host-key learn-host-cert fingerprint
gdsgate ca rotate [--all]¶
Requests a certificate-authority rotation. Authority runs the paced double-signing.
| Flag | Default | Purpose |
|---|---|---|
--all |
off | Rotate every rotatable CA with default settings. |
gdsgate ca host-keys learn <target>¶
Trust-on-first-use helper for the model-B jump-host path. Connects to
<target> (host or host:port, default port 22), reads the sshd host key,
and prints its SHA256:<base64> fingerprint on stdout for
[[connector.backends]].host_key_fingerprints or the file
host_key_fingerprints_file names.
Stderr carries a one-line preamble naming the target; exit code is non-zero on a connect / handshake failure.
gdsgate ca host-certs learn <target>¶
The same for a terminating desktop. Connects to <target> (host or
host:port, default port 3389), reads the TLS certificate of the Windows host,
and prints its sha256:<hex> fingerprint on stdout for
[[connector.backends]].host_cert_fingerprints or the file
host_cert_fingerprints_file names.
No credentials are sent and no session is opened. The fingerprint is of whatever answered at that address: run it once from a trusted network and keep the result.
Stderr carries a one-line preamble naming the target; exit code is non-zero on a connect / handshake failure.
gdsgate ca fingerprint [--file <path>]¶
Prints the SHA-256 fingerprint of the cluster's transport CA. Publish it to
users; gdsgate connect checks the cluster
against it.
Without --file, [proxy].public_cert_file takes priority: the command prints
the last CA in its chain and refuses a leaf-only file. It reads no private key.
Otherwise the anchor is read from ${enroll.state_dir}/transport-ca.pem
(written by an enrolled node), then from
[client].transport_ca. Stdout carries the
fingerprint only; stderr names the file it was read from. Exit code is non-zero
when no anchor is found or the file holds no certificate.
| Flag | Default | Purpose |
|---|---|---|
--file <path> |
from the configuration | Read this anchor file. |
A fingerprint does not authenticate a user. Confirm it before unattended bootstrap.