Certificates are time-limited credentials. Nokku uses certificate authority policy to choose defaults and enforce maximum lifetimes.
SSH user certificates
nk stores one signed certificate per certificate authority. Before an SSH connection, it checks the local certificate’s validity. If the certificate is missing, expired, or too close to expiry, it requests a replacement while the core is reachable.
An active SSH session is not ended merely because its certificate later expires. The certificate is checked during authentication.
SSH host certificates
For daemon-managed targets, nokkud generates the SSH host key, requests host certificates, and refreshes them before expiry. The daemon stores the CA public key and the signed host certificate under /var/lib/nokkud/ and reloads them into its embedded SSH server without a restart.
Revoking access
Removing a subject from a principal changes authorization and prevents new certificate issuance for that access. It does not make an already-issued certificate cryptographically disappear. That certificate remains valid until its expiry unless the server-side authorization check rejects it first.
For daemon-managed targets, policy updates are delivered over the control stream. During a core outage, the daemon continues using its last synchronized principal cache. Manual targets require their principal files to be edited directly.
Use short user certificate lifetimes when a small revocation window is important.
X.509 certificates
nk cert issue writes the private key, signed leaf certificate, and CA certificate chain to the chosen output directory. Expired X.509 certificates must be issued again. Applications must trust the Nokku X.509 CA through their normal trust configuration.
Rotating an X.509 CA changes the trust root and affects every certificate signed by the previous authority.