How to use this checklist
This is a quarterly audit of who can reach a shell, on which hosts, as which account, and for how long. It assumes an estate that has adopted certificates; run it anyway if you have not, because most of the items then read as gaps rather than as passes, and that is the useful output.
A quarter is the right cadence because the things this review catches accumulate rather than break. One appliance keeps a static key after a migration. One team copies a signing recipe written before the principal rules changed. One host misses a revocation list update and nobody notices, because nothing about a stale list looks different from a current one until the day it matters. A review that has not run in six months is describing an estate from two quarters ago.
Where the numbers come from
Certificate contents are read from certificates, by inspecting an actual issued file rather than the template that produced it. Server behaviour is read from the effective configuration the daemon computes, never from the file on disk, because included fragments and conditional blocks change the answer. Static key counts come from a filesystem walk on a representative sample of hosts, including the ones nobody administers any more.
Three items cannot be measured by a command. The time a revocation takes to reach the last host is a stopwatch exercise against the slowest machine. The refusal built into the signing tool is a property of code that no running host exposes. The break-glass path is proved by somebody having used it, and the record of that attempt is the evidence.
Access this needs
Read access to the server configuration and to a sample of issued certificates, permission to run the server binary in its configuration-test mode, read access to the authentication logs for the period under review, and a filesystem walk on a representative sample of hosts. The authority private keys are never read: their custody is reviewed through the access list and the storage description, not by opening the file.
What the review produces
A dated register listing the authority keys and their custodians, the validity intervals actually observed in issued certificates, the revocation reach time measured this quarter, the count of remaining static keys with an owner against each, and the outcome of the revocation drill. The register goes to whoever owns production access, and the static key count is the number that should move between quarters.
Sign-off
- Reviewer: ________________ Date: ___________
- Platform owner: ___________ Date: ___________
- Security owner: ___________ Date: ___________
Every critical item must pass. A failing critical item is a standing gap in production access control and must be resolved or formally accepted with a named owner before the review closes; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.