Deprecate ca_signature_algo config (#13033)

After the merge of https://github.com/gravitational/teleport/pull/12674 we no longer use the following configuration:
```yaml
teleport:
    ca_signature_algo: "rsa-sha2-512"
```
As we now rely upon the `x/crypto` package to choose the signing algorithm (it defaults to `rsa-sha2-512`)

**Demo**
If we set `ca_signature_algo` (the value is irrelevant) and start `teleport` we get:
```shell
root@marco:/workspace# teleport start --debug
2022-06-02T09:33:58Z WARN             ca_signing_algo config option is deprecated and will be ignored, we'll always default to rsa-sha2-512. config/configuration.go:348
2022-06-02T09:33:58Z INFO             Generating new host UUID: b001159a-10e0-49a7-b4dc-61c73fbe9e42. service/service.go:726
...
```

Fixes #12905

api/types/authority.go

@@ -71,10 +71,6 @@ type CertAuthority interface {
 	GetRotation() Rotation
 	// SetRotation sets rotation state.
 	SetRotation(Rotation)
-	// GetSigningAlg returns the signing algorithm used by signing keys.
-	GetSigningAlg() CertAuthoritySpecV2_SigningAlgType
-	// SetSigningAlg sets the signing algorithm used by signing keys.
-	SetSigningAlg(CertAuthoritySpecV2_SigningAlgType)
 	// AllKeyTypesMatch returns true if all keys in the CA are of the same type.
 	AllKeyTypesMatch() bool
 	// Clone returns a copy of the cert authority object.
@@ -263,16 +259,6 @@ func (ca *CertAuthorityV2) ID() *CertAuthID {
 	return &CertAuthID{DomainName: ca.Spec.ClusterName, Type: ca.Spec.Type}
 }
 
-// GetSigningAlg returns the CA's signing algorithm type
-func (ca *CertAuthorityV2) GetSigningAlg() CertAuthoritySpecV2_SigningAlgType {
-	return ca.Spec.SigningAlg
-}
-
-// SetSigningAlg sets the CA's signing algorith type
-func (ca *CertAuthorityV2) SetSigningAlg(alg CertAuthoritySpecV2_SigningAlgType) {
-	ca.Spec.SigningAlg = alg
-}
-
 func (ca *CertAuthorityV2) getOldKeySet(index int) (keySet CAKeySet) {
 	// in the "old" CA schema, index 0 contains the active keys and index 1 the
 	// additional trusted keys

docs/pages/setup/reference/config.mdx

@@ -210,11 +210,6 @@ teleport:
         write_max_capacity: int
         write_target_value: float
 
-    # CA Signing algorithm used for OpenSSH Certificates
-    # Defaults to rsa-sha2-512 in 4.3 and above.
-    # valid values are: ssh-rsa, rsa-sha2-256, rsa-sha2-512; ssh-rsa is SHA1
-    ca_signature_algo: "rsa-sha2-512"
-
     # Cipher algorithms that the server supports. This section only needs to be
     # set if you want to override the defaults.
     ciphers:

integration/helpers.go

@@ -212,7 +212,6 @@ func NewInstance(cfg InstanceConfig) *TeleInstance {
 
 	cert, err := keygen.GenerateHostCert(services.HostCertParams{
 		CASigner:      signer,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: cfg.Pub,
 		HostID:        cfg.HostID,
 		NodeName:      cfg.NodeName,
@@ -298,8 +297,6 @@ func (s *InstanceSecrets) GetCAs() ([]types.CertAuthority, error) {
 				Cert:    s.TLSCACert,
 			}},
 		},
-		Roles:      []string{},
-		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_512,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -320,8 +317,7 @@ func (s *InstanceSecrets) GetCAs() ([]types.CertAuthority, error) {
 				Cert:    s.TLSCACert,
 			}},
 		},
-		Roles:      []string{services.RoleNameForCertAuthority(s.SiteName)},
-		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_512,
+		Roles: []string{services.RoleNameForCertAuthority(s.SiteName)},
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -337,8 +333,6 @@ func (s *InstanceSecrets) GetCAs() ([]types.CertAuthority, error) {
 				Cert:    s.TLSCACert,
 			}},
 		},
-		Roles:      []string{},
-		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_512,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)

integration/integration_test.go

@@ -57,7 +57,6 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/bpf"
 	"github.com/gravitational/teleport/lib/client"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/events"
 	"github.com/gravitational/teleport/lib/pam"
 	"github.com/gravitational/teleport/lib/reversetunnel"
@@ -65,7 +64,6 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/session"
 	"github.com/gravitational/teleport/lib/srv"
-	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/utils"
 
 	"github.com/google/uuid"
@@ -191,7 +189,6 @@ func TestIntegrations(t *testing.T) {
 	t.Run("PortForwarding", suite.bind(testPortForwarding))
 	t.Run("ProxyHostKeyCheck", suite.bind(testProxyHostKeyCheck))
 	t.Run("ReverseTunnelCollapse", suite.bind(testReverseTunnelCollapse))
-	t.Run("RotateChangeSigningAlg", suite.bind(testRotateChangeSigningAlg))
 	t.Run("RotateRollback", suite.bind(testRotateRollback))
 	t.Run("RotateSuccess", suite.bind(testRotateSuccess))
 	t.Run("RotateTrustedClusters", suite.bind(testRotateTrustedClusters))
@@ -4210,154 +4207,6 @@ func testRotateTrustedClusters(t *testing.T, suite *integrationTestSuite) {
 	}
 }
 
-// TestRotateChangeSigningAlg tests the change of CA signing algorithm on
-// manual rotation.
-func testRotateChangeSigningAlg(t *testing.T, suite *integrationTestSuite) {
-	ctx := context.Background()
-	// Start with an instance using default signing alg.
-	tconf := suite.rotationConfig(true)
-	teleport := suite.newTeleportInstance()
-	logins := []string{suite.me.Username}
-	for _, login := range logins {
-		teleport.AddUser(login, []string{login})
-	}
-	config, err := teleport.GenerateConfig(t, nil, tconf)
-	require.NoError(t, err)
-
-	serviceC := make(chan *service.TeleportProcess, 20)
-	runErrCh := make(chan error, 1)
-
-	restart := func(svc *service.TeleportProcess, cancel func()) (*service.TeleportProcess, func()) {
-		if svc != nil && cancel != nil {
-			// shut down the service
-			cancel()
-			// close the service without waiting for the connections to drain
-			err := svc.Close()
-			require.NoError(t, err)
-			err = svc.Wait()
-			require.NoError(t, err)
-
-			select {
-			case err := <-runErrCh:
-				require.NoError(t, err)
-			case <-time.After(20 * time.Second):
-				t.Fatalf("failed to shut down the server")
-			}
-		}
-
-		ctx, cancel := context.WithCancel(context.Background())
-		go func() {
-			runErrCh <- service.Run(ctx, *config, func(cfg *service.Config) (service.Process, error) {
-				svc, err := service.NewTeleport(cfg, service.WithIMDSClient(&disabledIMDSClient{}))
-				if err == nil {
-					serviceC <- svc
-				}
-				return svc, err
-			})
-		}()
-
-		svc, err = waitForProcessStart(serviceC)
-		require.NoError(t, err)
-		return svc, cancel
-	}
-
-	assertSigningAlg := func(svc *service.TeleportProcess, alg string) {
-		hostCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.HostCA, DomainName: Site}, false)
-		require.NoError(t, err)
-		require.Equal(t, alg, sshutils.GetSigningAlgName(hostCA))
-
-		userCA, err := svc.GetAuthServer().GetCertAuthority(ctx, types.CertAuthID{Type: types.UserCA, DomainName: Site}, false)
-		require.NoError(t, err)
-		require.Equal(t, alg, sshutils.GetSigningAlgName(userCA))
-	}
-
-	rotate := func(svc *service.TeleportProcess, mode string) *service.TeleportProcess {
-		t.Logf("Rotation phase: %q.", types.RotationPhaseInit)
-		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
-			TargetPhase: types.RotationPhaseInit,
-			Mode:        mode,
-		})
-		require.NoError(t, err)
-
-		// wait until service phase update to be broadcasted (init phase does not trigger reload)
-		err = waitForProcessEvent(svc, service.TeleportPhaseChangeEvent, 10*time.Second)
-		require.NoError(t, err)
-
-		t.Logf("Rotation phase: %q.", types.RotationPhaseUpdateClients)
-		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
-			TargetPhase: types.RotationPhaseUpdateClients,
-			Mode:        mode,
-		})
-		require.NoError(t, err)
-
-		// wait until service reload
-		svc, err = waitForReload(serviceC, svc)
-		require.NoError(t, err)
-
-		t.Logf("Rotation phase: %q.", types.RotationPhaseUpdateServers)
-		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
-			TargetPhase: types.RotationPhaseUpdateServers,
-			Mode:        mode,
-		})
-		require.NoError(t, err)
-
-		// wait until service reloaded
-		svc, err = waitForReload(serviceC, svc)
-		require.NoError(t, err)
-
-		t.Logf("rotation phase: %q", types.RotationPhaseStandby)
-		err = svc.GetAuthServer().RotateCertAuthority(ctx, auth.RotateRequest{
-			TargetPhase: types.RotationPhaseStandby,
-			Mode:        mode,
-		})
-		require.NoError(t, err)
-
-		// wait until service reloaded
-		svc, err = waitForReload(serviceC, svc)
-		require.NoError(t, err)
-
-		return svc
-	}
-
-	// Start the instance.
-	svc, cancel := restart(nil, nil)
-
-	t.Log("default signature algorithm due to empty config value")
-	// Verify the default signing algorithm with config value empty.
-	assertSigningAlg(svc, defaults.CASignatureAlgorithm)
-
-	t.Log("change signature algorithm with custom config value and manual rotation")
-	// Change the signing algorithm in config file.
-	signingAlg := ssh.KeyAlgoRSA
-	config.CASignatureAlgorithm = &signingAlg
-	svc, cancel = restart(svc, cancel)
-	// Do a manual rotation - this should change the signing algorithm.
-	svc = rotate(svc, types.RotationModeManual)
-	assertSigningAlg(svc, ssh.KeyAlgoRSA)
-
-	t.Log("preserve signature algorithm with empty config value and manual rotation")
-	// Unset the config value.
-	config.CASignatureAlgorithm = nil
-	svc, cancel = restart(svc, cancel)
-
-	// Do a manual rotation - this should leave the signing algorithm
-	// unaffected because config value is not set.
-	svc = rotate(svc, types.RotationModeManual)
-	assertSigningAlg(svc, ssh.KeyAlgoRSA)
-
-	// shut down the service
-	cancel()
-	// close the service without waiting for the connections to drain
-	svc.Close()
-
-	select {
-	case err := <-runErrCh:
-		require.NoError(t, err)
-	case <-time.After(20 * time.Second):
-		t.Fatalf("failed to shut down the server")
-	}
-}
-
 // rotationConfig sets up default config used for CA rotation tests
 func (s *integrationTestSuite) rotationConfig(disableWebService bool) *service.Config {
 	tconf := s.defaultServiceConfig()

lib/auth/auth.go

@@ -180,7 +180,6 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		oidcClients:     make(map[string]*oidcClient),
 		samlProviders:   make(map[string]*samlProvider),
 		githubClients:   make(map[string]*githubClient),
-		caSigningAlg:    cfg.CASigningAlg,
 		cancelFunc:      cancelFunc,
 		closeCtx:        closeCtx,
 		emitter:         cfg.Emitter,
@@ -339,9 +338,6 @@ type Server struct {
 	// cipherSuites is a list of ciphersuites that the auth server supports.
 	cipherSuites []uint16
 
-	// caSigningAlg is an SSH signing algorithm to use when generating new CAs.
-	caSigningAlg *string
-
 	// cache is a fast cache that allows auth server
 	// to use cache for most frequent operations,
 	// if not set, cache uses itself
@@ -673,7 +669,6 @@ func (a *Server) GenerateHostCert(hostPublicKey []byte, hostID, nodeName string,
 	// create and sign!
 	return a.generateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  sshutils.GetSigningAlgName(ca),
 		PublicHostKey: hostPublicKey,
 		HostID:        hostID,
 		NodeName:      nodeName,
@@ -1069,7 +1064,6 @@ func (a *Server) generateUserCert(req certRequest) (*proto.Certs, error) {
 
 	params := services.UserCertParams{
 		CASigner:              caSigner,
-		CASigningAlg:          sshutils.GetSigningAlgName(userCA),
 		PublicUserKey:         req.publicKey,
 		Username:              req.user.GetName(),
 		Impersonator:          req.impersonator,
@@ -2178,7 +2172,6 @@ func (a *Server) GenerateHostCerts(ctx context.Context, req *proto.HostCertsRequ
 	// generate host SSH certificate
 	hostSSHCert, err := a.generateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  sshutils.GetSigningAlgName(ca),
 		PublicHostKey: req.PublicSSHKey,
 		HostID:        req.HostID,
 		NodeName:      req.NodeName,
@@ -3580,15 +3573,10 @@ func (a *Server) createSelfSignedCA(caID types.CertAuthID) error {
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	sigAlg := defaults.CASignatureAlgorithm
-	if a.caSigningAlg != nil && *a.caSigningAlg != "" {
-		sigAlg = *a.caSigningAlg
-	}
 	ca, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
 		Type:        caID.Type,
 		ClusterName: caID.DomainName,
 		ActiveKeys:  keySet,
-		SigningAlg:  sshutils.ParseSigningAlg(sigAlg),
 	})
 	if err != nil {
 		return trace.Wrap(err)

lib/auth/clt_test.go

@@ -165,8 +165,6 @@ func newCertAuthority(t *testing.T, name string, caType types.CertAuthType) type
 				Key:  key,
 			}},
 		},
-		Roles:      nil,
-		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_256,
 	})
 	require.NoError(t, err)
 	return ca

lib/auth/init.go

@@ -159,11 +159,6 @@ type InitConfig struct {
 	// CipherSuites is a list of ciphersuites that the auth server supports.
 	CipherSuites []uint16
 
-	// CASigningAlg is a signing algorithm used for SSH (certificate and
-	// handshake) signatures for both host and user CAs. This option only
-	// affects newly-created CAs.
-	CASigningAlg *string
-
 	// Emitter is events emitter, used to submit discrete events
 	Emitter apievents.Emitter
 
@@ -1105,7 +1100,6 @@ func migrateDBAuthority(ctx context.Context, asrv *Server) error {
 				// Copy only TLS keys as SSH are not needed.
 				TLS: cav2.Spec.ActiveKeys.TLS,
 			},
-			SigningAlg: cav2.Spec.SigningAlg,
 		})
 		if err != nil {
 			return trace.Wrap(err)

lib/auth/init_test.go

@@ -31,7 +31,6 @@ import (
 	"github.com/gravitational/teleport/lib/auth/testauthority"
 	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/backend/lite"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/services/suite"
@@ -61,7 +60,6 @@ func TestReadIdentity(t *testing.T) {
 
 	cert, err := a.GenerateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: pub,
 		HostID:        "id1",
 		NodeName:      "node-name",
@@ -83,7 +81,6 @@ func TestReadIdentity(t *testing.T) {
 	expiryDate := clock.Now().Add(ttl)
 	bytes, err := a.GenerateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: pub,
 		HostID:        "id1",
 		NodeName:      "node-name",
@@ -111,7 +108,6 @@ func TestBadIdentity(t *testing.T) {
 	// missing authority domain
 	cert, err := a.GenerateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: pub,
 		HostID:        "id2",
 		NodeName:      "",
@@ -127,7 +123,6 @@ func TestBadIdentity(t *testing.T) {
 	// missing host uuid
 	cert, err = a.GenerateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: pub,
 		HostID:        "example.com",
 		NodeName:      "",
@@ -143,7 +138,6 @@ func TestBadIdentity(t *testing.T) {
 	// unrecognized role
 	cert, err = a.GenerateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: pub,
 		HostID:        "example.com",
 		NodeName:      "",
@@ -447,51 +441,6 @@ func TestClusterName(t *testing.T) {
 	require.Equal(t, conf.ClusterName.GetClusterName(), cn.GetClusterName())
 }
 
-func TestCASigningAlg(t *testing.T) {
-	ctx := context.Background()
-	verifyCAs := func(auth *Server, alg string) {
-		hostCAs, err := auth.GetCertAuthorities(ctx, types.HostCA, false)
-		require.NoError(t, err)
-		for _, ca := range hostCAs {
-			require.Equal(t, sshutils.GetSigningAlgName(ca), alg)
-		}
-		userCAs, err := auth.GetCertAuthorities(ctx, types.UserCA, false)
-		require.NoError(t, err)
-		for _, ca := range userCAs {
-			require.Equal(t, sshutils.GetSigningAlgName(ca), alg)
-		}
-	}
-
-	// Start a new server without specifying a signing alg.
-	conf := setupConfig(t)
-	auth, err := Init(conf)
-	require.NoError(t, err)
-	defer auth.Close()
-	verifyCAs(auth, ssh.KeyAlgoRSASHA512)
-
-	require.NoError(t, auth.Close())
-
-	// Reset the auth server state.
-	conf.Backend, err = lite.New(context.TODO(), backend.Params{"path": t.TempDir()})
-	require.NoError(t, err)
-	conf.DataDir = t.TempDir()
-
-	// Start a new server with non-default signing alg.
-	signingAlg := ssh.KeyAlgoRSA
-	conf.CASigningAlg = &signingAlg
-	auth, err = Init(conf)
-	require.NoError(t, err)
-	defer auth.Close()
-	verifyCAs(auth, ssh.KeyAlgoRSA)
-
-	// Start again, using a different alg. This should not change the existing
-	// CA.
-	signingAlg = ssh.KeyAlgoRSASHA256
-	auth, err = Init(conf)
-	require.NoError(t, err)
-	verifyCAs(auth, ssh.KeyAlgoRSA)
-}
-
 // TestPresets tests behavior of presets
 func TestPresets(t *testing.T) {
 	ctx := context.Background()

lib/auth/native/native_test.go

@@ -27,7 +27,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	"github.com/gravitational/teleport/lib/auth/test"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 
@@ -163,7 +162,6 @@ func (s *NativeSuite) TestBuildPrincipals(c *check.C) {
 		hostCertificateBytes, err := s.suite.A.GenerateHostCert(
 			services.HostCertParams{
 				CASigner:      caSigner,
-				CASigningAlg:  defaults.CASignatureAlgorithm,
 				PublicHostKey: hostPublicKey,
 				HostID:        tt.inHostID,
 				NodeName:      tt.inNodeName,
@@ -211,7 +209,6 @@ func (s *NativeSuite) TestUserCertCompatibility(c *check.C) {
 
 		userCertificateBytes, err := s.suite.A.GenerateUserCert(services.UserCertParams{
 			CASigner:      caSigner,
-			CASigningAlg:  defaults.CASignatureAlgorithm,
 			PublicUserKey: pub,
 			Username:      "user",
 			AllowedLogins: []string{"centos", "root"},
@@ -232,8 +229,6 @@ func (s *NativeSuite) TestUserCertCompatibility(c *check.C) {
 
 		userCertificate, err := sshutils.ParseCertificate(userCertificateBytes)
 		c.Assert(err, check.IsNil, comment)
-		// Check that the signature algorithm is correct.
-		c.Assert(userCertificate.Signature.Format, check.Equals, defaults.CASignatureAlgorithm)
 		// check if we added the roles extension
 		_, ok := userCertificate.Extensions[teleport.CertExtensionTeleportRoles]
 		c.Assert(ok, check.Equals, tt.outHasRoles, comment)

lib/auth/rotate.go

@@ -26,7 +26,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
-	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 
@@ -128,8 +127,6 @@ type rotationReq struct {
 	// privateKey is passed by tests to supply private key for cert authorities
 	// instead of generating them on each iteration
 	privateKey []byte
-	// caSigningAlg is an SSH signing algorithm to use with the new CA.
-	caSigningAlg *string
 }
 
 // RotateCertAuthority starts or restarts certificate authority rotation process.
@@ -228,14 +225,13 @@ func (a *Server) RotateCertAuthority(ctx context.Context, req RotateRequest) err
 		}
 
 		rotated, err := a.processRotationRequest(rotationReq{
-			ca:           existing,
-			clock:        a.clock,
-			targetPhase:  req.TargetPhase,
-			schedule:     *req.Schedule,
-			gracePeriod:  *req.GracePeriod,
-			mode:         req.Mode,
-			privateKey:   a.privateKey,
-			caSigningAlg: a.caSigningAlg,
+			ca:          existing,
+			clock:       a.clock,
+			targetPhase: req.TargetPhase,
+			schedule:    *req.Schedule,
+			gracePeriod: *req.GracePeriod,
+			mode:        req.Mode,
+			privateKey:  a.privateKey,
 		})
 		if err != nil {
 			return trace.Wrap(err)
@@ -696,12 +692,6 @@ func (a *Server) startNewRotation(req rotationReq, ca types.CertAuthority) error
 	}
 
 	ca.SetRotation(rotation)
-	// The certificate signing algorithm is only set when signing algorithm is
-	// explicitly set in the config file. If the config file doesn't set a value,
-	// preserve the signing algorithm of the existing CA.
-	if req.caSigningAlg != nil {
-		sshutils.SetSigningAlgName(ca, *req.caSigningAlg)
-	}
 
 	return nil
 }

lib/auth/test/suite.go

@@ -64,7 +64,6 @@ func (s *AuthSuite) GenerateHostCert(c *check.C) {
 	cert, err := s.A.GenerateHostCert(
 		services.HostCertParams{
 			CASigner:      caSigner,
-			CASigningAlg:  defaults.CASignatureAlgorithm,
 			PublicHostKey: pub,
 			HostID:        "00000000-0000-0000-0000-000000000000",
 			NodeName:      "auth.example.com",
@@ -95,7 +94,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) {
 
 	cert, err := s.A.GenerateUserCert(services.UserCertParams{
 		CASigner:              caSigner,
-		CASigningAlg:          defaults.CASignatureAlgorithm,
 		PublicUserKey:         pub,
 		Username:              "user",
 		AllowedLogins:         []string{"centos", "root"},
@@ -113,7 +111,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) {
 
 	cert, err = s.A.GenerateUserCert(services.UserCertParams{
 		CASigner:              caSigner,
-		CASigningAlg:          defaults.CASignatureAlgorithm,
 		PublicUserKey:         pub,
 		Username:              "user",
 		AllowedLogins:         []string{"root"},
@@ -128,7 +125,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) {
 
 	_, err = s.A.GenerateUserCert(services.UserCertParams{
 		CASigner:              caSigner,
-		CASigningAlg:          defaults.CASignatureAlgorithm,
 		PublicUserKey:         pub,
 		Username:              "user",
 		AllowedLogins:         []string{"root"},
@@ -143,7 +139,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) {
 
 	_, err = s.A.GenerateUserCert(services.UserCertParams{
 		CASigner:              caSigner,
-		CASigningAlg:          defaults.CASignatureAlgorithm,
 		PublicUserKey:         pub,
 		Username:              "user",
 		AllowedLogins:         []string{"root"},
@@ -158,7 +153,6 @@ func (s *AuthSuite) GenerateUserCert(c *check.C) {
 	impersonator := "alice"
 	cert, err = s.A.GenerateUserCert(services.UserCertParams{
 		CASigner:              caSigner,
-		CASigningAlg:          defaults.CASignatureAlgorithm,
 		PublicUserKey:         pub,
 		Username:              "user",
 		Impersonator:          impersonator,

lib/client/identityfile/identity_test.go

@@ -93,7 +93,6 @@ func newClientKey(t *testing.T) *client.Key {
 
 	certificate, err := keygen.GenerateUserCert(services.UserCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicUserKey: publicKey,
 		Username:      "testuser",
 	})

lib/client/keyagent_test.go

@@ -36,7 +36,6 @@ import (
 	"github.com/gravitational/teleport/api/utils/keypaths"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/fixtures"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/sshutils"
@@ -272,7 +271,6 @@ func TestHostCertVerification(t *testing.T) {
 	require.NoError(t, err)
 	hostCertBytes, err := keygen.GenerateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: hostPub,
 		HostID:        "5ff40d80-9007-4f28-8f49-7d4fda2f574d",
 		NodeName:      "server01",
@@ -520,7 +518,6 @@ func (s *KeyAgentTestSuite) makeKey(username string, allowedLogins []string, ttl
 
 	certificate, err := keygen.GenerateUserCert(services.UserCertParams{
 		CASigner:              caSigner,
-		CASigningAlg:          defaults.CASignatureAlgorithm,
 		PublicUserKey:         publicKey,
 		Username:              username,
 		AllowedLogins:         allowedLogins,

lib/client/keystore_test.go

@@ -255,7 +255,6 @@ func TestProxySSHConfig(t *testing.T) {
 
 	hostCert, err := s.keygen.GenerateHostCert(services.HostCertParams{
 		CASigner:      caSigner,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: hostPub,
 		HostID:        "127.0.0.1",
 		NodeName:      "127.0.0.1",
@@ -465,7 +464,6 @@ func (s *keyStoreTest) makeSignedKey(t *testing.T, idx KeyIndex, makeExpired boo
 
 	cert, err = s.keygen.GenerateUserCert(services.UserCertParams{
 		CASigner:              caSigner,
-		CASigningAlg:          defaults.CASignatureAlgorithm,
 		PublicUserKey:         pub,
 		Username:              idx.Username,
 		AllowedLogins:         allowedLogins,

lib/client/known_hosts_migrate_test.go

@@ -23,7 +23,6 @@ import (
 	"testing"
 
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
@@ -51,7 +50,6 @@ func generateHostCert(t *testing.T, s *knownHostsMigrateTest, clusterName string
 		HostID:        "127.0.0.1",
 		NodeName:      "127.0.0.1",
 		ClusterName:   clusterName,
-		CASigningAlg:  defaults.CASignatureAlgorithm,
 		PublicHostKey: hostPub,
 	})
 	require.Nil(t, err)

lib/config/configuration.go

@@ -345,7 +345,7 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error {
 		cfg.MACAlgorithms = fc.MACAlgorithms
 	}
 	if fc.CASignatureAlgorithm != nil {
-		cfg.CASignatureAlgorithm = fc.CASignatureAlgorithm
+		log.Warn("ca_signing_algo config option is deprecated and will be removed in a future release, Teleport defaults to rsa-sha2-512.")
 	}
 
 	// Read in how nodes will validate the CA. A single empty string in the file
@@ -1493,8 +1493,6 @@ func parseAuthorizedKeys(bytes []byte, allowedLogins []string) (types.CertAuthor
 				PublicKey: ssh.MarshalAuthorizedKey(pubkey),
 			}},
 		},
-		Roles:      nil,
-		SigningAlg: types.CertAuthoritySpecV2_UNKNOWN,
 	})
 	if err != nil {
 		return nil, nil, trace.Wrap(err)

lib/config/configuration_test.go

@@ -606,21 +606,6 @@ teleport:
     - kexAlgoCurve25519SHA256
   mac_algos:
     - hmac-sha2-256-etm@openssh.com
-`,
-			outError: true,
-		},
-		{
-			desc: "change CA signature alg, valid",
-			inConfig: `
-teleport:
-  ca_signature_algo: ssh-rsa
-`,
-		},
-		{
-			desc: "invalid CA signature alg, not valid",
-			inConfig: `
-teleport:
-  ca_signature_algo: foobar
 `,
 			outError: true,
 		},

lib/config/fileconf.go

@@ -54,12 +54,6 @@ import (
 	"gopkg.in/yaml.v2"
 )
 
-var validCASigAlgos = []string{
-	ssh.KeyAlgoRSA,
-	ssh.KeyAlgoRSASHA256,
-	ssh.KeyAlgoRSASHA512,
-}
-
 // FileConfig structre represents the teleport configuration stored in a config file
 // in YAML format (usually /etc/teleport.yaml)
 //
@@ -426,9 +420,6 @@ func (conf *FileConfig) CheckAndSetDefaults() error {
 			return trace.BadParameter("MAC algorithm %q is not supported; supported algorithms: %q", m, sc.MACs)
 		}
 	}
-	if conf.CASignatureAlgorithm != nil && !apiutils.SliceContainsStr(validCASigAlgos, *conf.CASignatureAlgorithm) {
-		return trace.BadParameter("CA signature algorithm %q is not supported; supported algorithms: %q", *conf.CASignatureAlgorithm, validCASigAlgos)
-	}
 
 	return nil
 }
@@ -543,9 +534,7 @@ type Global struct {
 	// the server supports. If omitted the defaults will be used.
 	MACAlgorithms []string `yaml:"mac_algos,omitempty"`
 
-	// CASignatureAlgorithm is an SSH Certificate Authority (CA) signature
-	// algorithm that the server uses for signing user and host certificates.
-	// If omitted, the default will be used.
+	// CASignatureAlgorithm is ignored but ketp for config backwards compat
 	CASignatureAlgorithm *string `yaml:"ca_signature_algo,omitempty"`
 
 	// CAPin is the SKPI hash of the CA used to verify the Auth Server. Can be

lib/defaults/defaults.go

@@ -30,8 +30,6 @@ import (
 
 	"github.com/gravitational/trace"
 	"gopkg.in/square/go-jose.v2"
-
-	"golang.org/x/crypto/ssh"
 )
 
 // Default port numbers used by all teleport tools
@@ -378,10 +376,6 @@ var (
 	// WindowsDesktopQueueSize is windows_desktop service watch queue size.
 	WindowsDesktopQueueSize = 128
 
-	// CASignatureAlgorithm is the default signing algorithm to use when
-	// creating new SSH CAs.
-	CASignatureAlgorithm = ssh.KeyAlgoRSASHA512
-
 	// SessionControlTimeout is the maximum amount of time a controlled session
 	// may persist after contact with the auth server is lost (sessctl semaphore
 	// leases are refreshed at a rate of ~1/2 this duration).

lib/reversetunnel/srv_test.go

@@ -27,7 +27,6 @@ import (
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 
@@ -53,8 +52,6 @@ func TestServerKeyAuth(t *testing.T) {
 				PublicKey:      pub,
 			}},
 		},
-		Roles:      nil,
-		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_256,
 	})
 	require.NoError(t, err)
 
@@ -76,7 +73,6 @@ func TestServerKeyAuth(t *testing.T) {
 			key: func() ssh.PublicKey {
 				rawCert, err := ta.GenerateHostCert(services.HostCertParams{
 					CASigner:      caSigner,
-					CASigningAlg:  defaults.CASignatureAlgorithm,
 					PublicHostKey: pub,
 					HostID:        "host-id",
 					NodeName:      con.User(),
@@ -101,7 +97,6 @@ func TestServerKeyAuth(t *testing.T) {
 			key: func() ssh.PublicKey {
 				rawCert, err := ta.GenerateUserCert(services.UserCertParams{
 					CASigner:          caSigner,
-					CASigningAlg:      defaults.CASignatureAlgorithm,
 					PublicUserKey:     pub,
 					Username:          con.User(),
 					AllowedLogins:     []string{con.User()},

lib/service/cfg.go

@@ -192,11 +192,6 @@ type Config struct {
 	// the server supports. If omitted the defaults will be used.
 	MACAlgorithms []string
 
-	// CASignatureAlgorithm is an SSH Certificate Authority (CA) signature
-	// algorithm that the server uses for signing user and host certificates.
-	// If omitted, the default will be used.
-	CASignatureAlgorithm *string
-
 	// DiagnosticAddr is an address for diagnostic and healthz endpoint service
 	DiagnosticAddr utils.NetAddr
 

lib/service/cfg_test.go

@@ -71,7 +71,6 @@ func TestDefaultConfig(t *testing.T) {
 		"hmac-sha2-256-etm@openssh.com",
 		"hmac-sha2-256",
 	})
-	require.Nil(t, config.CASignatureAlgorithm)
 
 	// auth section
 	auth := config.Auth

lib/service/service.go

@@ -1333,7 +1333,6 @@ func (process *TeleportProcess) initAuthService() error {
 		OIDCConnectors:          cfg.OIDCConnectors,
 		AuditLog:                process.auditLog,
 		CipherSuites:            cfg.CipherSuites,
-		CASigningAlg:            cfg.CASignatureAlgorithm,
 		KeyStoreConfig:          cfg.Auth.KeyStore,
 		Emitter:                 checkingEmitter,
 		Streamer:                events.NewReportingStreamer(checkingStreamer, process.Config.UploadEventsC),

lib/services/authority.go

@@ -197,8 +197,6 @@ func GetSSHCheckingKeys(ca types.CertAuthority) [][]byte {
 type HostCertParams struct {
 	// CASigner is the signer that will sign the public key of the host with the CA private key.
 	CASigner ssh.Signer
-	// CASigningAlg is the signature algorithm used by the CA private key.
-	CASigningAlg string
 	// PublicHostKey is the public key of the host
 	PublicHostKey []byte
 	// HostID is used by Teleport to uniquely identify a node within a cluster
@@ -217,8 +215,8 @@ type HostCertParams struct {
 
 // Check checks parameters for errors
 func (c HostCertParams) Check() error {
-	if c.CASigner == nil || c.CASigningAlg == "" {
-		return trace.BadParameter("CASigner and CASigningAlg are required")
+	if c.CASigner == nil {
+		return trace.BadParameter("CASigner is required")
 	}
 	if c.HostID == "" && len(c.Principals) == 0 {
 		return trace.BadParameter("HostID [%q] or Principals [%q] are required",
@@ -253,8 +251,6 @@ type ChangePasswordReq struct {
 type UserCertParams struct {
 	// CASigner is the signer that will sign the public key of the user with the CA private key
 	CASigner ssh.Signer
-	// CASigningAlg is the signature algorithm used by the CA private key.
-	CASigningAlg string
 	// PublicUserKey is the public key of the user
 	PublicUserKey []byte
 	// TTL defines how long a certificate is valid for
@@ -304,8 +300,8 @@ type UserCertParams struct {
 
 // CheckAndSetDefaults checks the user certificate parameters
 func (c *UserCertParams) CheckAndSetDefaults() error {
-	if c.CASigner == nil || c.CASigningAlg == "" {
-		return trace.BadParameter("CASigner and CASigningAlg are required")
+	if c.CASigner == nil {
+		return trace.BadParameter("CASigner is required")
 	}
 	if c.TTL < defaults.MinCertDuration {
 		c.TTL = defaults.MinCertDuration

lib/services/watcher_test.go

@@ -866,8 +866,6 @@ func newCertAuthority(t *testing.T, name string, caType types.CertAuthType) type
 				},
 			},
 		},
-		Roles:      nil,
-		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_256,
 	})
 	require.NoError(t, err)
 	return ca

lib/sshutils/authority.go

@@ -71,43 +71,3 @@ func ValidateSigners(ca types.CertAuthority) error {
 	}
 	return nil
 }
-
-// GetSigningAlgName returns the CA's signing algorithm type
-func GetSigningAlgName(ca types.CertAuthority) string {
-	switch ca.GetSigningAlg() {
-	// UNKNOWN algorithm can come from a cluster that existed before SigningAlg
-	// field was added. Default to RSA-SHA1 to match the implicit algorithm
-	// used in those clusters.
-	case types.CertAuthoritySpecV2_RSA_SHA1, types.CertAuthoritySpecV2_UNKNOWN:
-		return ssh.KeyAlgoRSA
-	case types.CertAuthoritySpecV2_RSA_SHA2_256:
-		return ssh.KeyAlgoRSASHA256
-	case types.CertAuthoritySpecV2_RSA_SHA2_512:
-		return ssh.KeyAlgoRSASHA512
-	default:
-		return ""
-	}
-}
-
-// SetSigningAlgName sets the signing algorithm type for the given CA
-func SetSigningAlgName(ca types.CertAuthority, alg string) {
-	ca.SetSigningAlg(ParseSigningAlg(alg))
-}
-
-// ParseSigningAlg converts the name of the SSH signature algorithm to the
-// corresponding proto enum value.
-//
-// alg should be one of ssh.SigAlgo* constants. If it's not one of those
-// constants, types.CertAuthoritySpecV2_UNKNOWN is returned.
-func ParseSigningAlg(alg string) types.CertAuthoritySpecV2_SigningAlgType {
-	switch alg {
-	case ssh.KeyAlgoRSA:
-		return types.CertAuthoritySpecV2_RSA_SHA1
-	case ssh.KeyAlgoRSASHA256:
-		return types.CertAuthoritySpecV2_RSA_SHA2_256
-	case ssh.KeyAlgoRSASHA512:
-		return types.CertAuthoritySpecV2_RSA_SHA2_512
-	default:
-		return types.CertAuthoritySpecV2_UNKNOWN
-	}
-}

tool/tctl/common/auth_command_test.go

@@ -66,8 +66,6 @@ func TestAuthSignKubeconfig(t *testing.T) {
 			SSH: []*types.SSHKeyPair{{PublicKey: []byte("SSH CA cert")}},
 			TLS: []*types.TLSKeyPair{{Cert: cert}},
 		},
-		Roles:      nil,
-		SigningAlg: types.CertAuthoritySpecV2_RSA_SHA2_512,
 	})
 	require.NoError(t, err)