Custom root CA for x.509 commit signing?

[avidal]

Body

For Enterprise Cloud, you can upload a custom ssh root CA. Can we do the same for x.509 commit signatures to get a Verified badge using a self-signed root?

edit: I did a test myself using an Enterprise Cloud trial. The Enterprise setting for uploading your own SSH CA is very explicit about only accepting an SSH private key afaict.

GitLab supports this by allowing enterprise admins to augment the certificate trust store which applies both to SSH certificates and x.509 commit signature certificates.

[queenofcorgis]

Hi there @avidal,

Have you tried this:

If the local client knows about the root, that same root is installed in the org, the signing cert is installed locally, the signing cert is attached to their github profile, and their ssh client knows to use the cert it could work.

[avidal]

This isn't for SSH certificates, it's for x.509 certificates used for commit signing. The value add for using x.509 is that you don't have to upload a public key to GitHub and that a verified signature stays verified without requiring that the user keeps public keys attached to their profile forever.

[trishankatdatadog]

Yes, also, the main requirement for the request here is so that X.509 commits using a self-signed root CA could show up as Verified on GitHub[.]com.

[joshjohanning]

@avidal - I think so? See the docs: https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#smime-commit-signature-verification

I have never done this myself, though.

[avidal]

Yes. It works to sign commits using x.509. And if you have a certificate issued by a trusted root, it'll show up as Verified.

The ask here is: for an Enterprise Cloud account, how can I get a Verified badge for x.509 signatures where the certificate is issued by a self-signed root? You can do this for a custom SSH CA, but not for traditional x.509.

The docs say:

You can use S/MIME to sign commits with an X.509 key issued by your organization.

But this is incorrect, as best I can tell. You need an X.509 key issued by a trusted root (even if your organization ultimately delivers it to you), because GitHub does not allow an organization to add their own self-signed root to the trust store for commit signature verification.

[joshjohanning]

I see what you are saying now with the untrusted / self-signed cert. I am unsure though 😢

[trishankatdatadog]

Would you happen to know any enterprise customer who has gotten an intermediate cert signed by a 3p root CA for the purposes of signing git commits? If so, how difficult was the process?