@andrewheberle/serverless-ssh-ca 0.23.0 → 0.24.1

package/src/ssh/keys.ts

@@ -118,6 +118,39 @@ export class PublicKey {
 	}
 }
 
+/**
+ * The smallest RSA key, in bits, that the CA will issue a certificate for.
+ * This matches the minimum accepted by ssh-ca-client.
+ */
+export const MinimumRsaKeyBits = 2048
+
+/**
+ * Returns the size in bits of the modulus of an RSA public key, or undefined
+ * if the key is not an RSA key.
+ *
+ * @param key The public key
+ */
+export const rsaKeyBits = (key: PublicKey): number | undefined => {
+	if (key.type !== "ssh-rsa") {
+		return undefined
+	}
+
+	// the fields of an RSA key are the exponent and the modulus, an mpint
+	// that may have a leading zero byte to keep it positive
+	const modulus = decodePublicKey(key.blob).fields[1]
+	if (modulus === undefined) {
+		return undefined
+	}
+
+	const start = modulus.findIndex((byte) => byte !== 0)
+	const first = modulus[start]
+	if (start === -1 || first === undefined) {
+		return 0
+	}
+
+	return (modulus.length - start - 1) * 8 + first.toString(2).length
+}
+
 /** The ECDSA curves that can be used to sign */
 export type EcdsaCurve = "nistp256" | "nistp384" | "nistp521"
 
@@ -190,24 +223,97 @@ const keyTypeName = (type: string): string => {
 	return type.replace(/^ssh-/, "").replace(/^ecdsa-sha2-.*$/, "ecdsa")
 }
 
+// decodes the base64 body of a PEM block
+const decodePem = (body: string): Uint8Array<ArrayBuffer> => {
+	try {
+		return new Uint8Array(base64.decode(body.replace(/\s+/g, "")))
+	} catch (err) {
+		throw new KeyParseError("private key could not be decoded", err)
+	}
+}
+
+/** The algorithms that an unencrypted PKCS#8 private key is imported as, in the order they are tried */
+const Pkcs8Algorithms: readonly ({ type: "ed25519", algorithm: Algorithm } | { type: "ecdsa", curve: EcdsaCurve, algorithm: EcKeyImportParams })[] = [
+	{ type: "ed25519", algorithm: { name: "Ed25519" } },
+	...(["nistp256", "nistp384", "nistp521"] as const).map((curve) => ({ type: "ecdsa" as const, curve, algorithm: { name: "ECDSA", namedCurve: EcdsaCurves[curve].namedCurve } })),
+]
+
+// imports a PKCS#8 private key, returning undefined if it is not a key for
+// the algorithm
+const importPkcs8 = async (der: Uint8Array<ArrayBuffer>, algorithm: Algorithm | EcKeyImportParams | RsaHashedImportParams): Promise<CryptoKey | undefined> => {
+	try {
+		return await crypto.subtle.importKey("pkcs8", der, algorithm, true, ["sign"])
+	} catch {
+		return undefined
+	}
+}
+
+// returns a member of a JWK exported by WebCrypto, which is always present
+// for the key types that are exported
+const jwkMember = (jwk: JsonWebKey, name: "d" | "x" | "y"): string => {
+	const value = jwk[name]
+	if (value === undefined) {
+		throw new KeyParseError(`private key was missing "${name}" when exported`)
+	}
+
+	return value
+}
+
 /**
- * Parses an unencrypted Ed25519 or ECDSA private key in OpenSSH format, as
- * created by `ssh-keygen`
- *
- * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----`
- * @returns The private key
- * @throws {@link KeyParseError} when the key cannot be parsed or is encrypted
- * @throws {@link UnsupportedKeyError} when the key is not an Ed25519 or ECDSA key
+ * Parses an unencrypted Ed25519 or ECDSA private key in PKCS#8 format, as
+ * created by `ssh-keygen -m PKCS8` or `openssl genpkey`
  */
-export const parsePrivateKey = (text: string): PrivateKey => {
-	const match = /-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]*?)-----END OPENSSH PRIVATE KEY-----/.exec(text)
-	if (match === null) {
-		throw new KeyParseError("private key was not in OpenSSH format, as created by ssh-keygen (starting with -----BEGIN OPENSSH PRIVATE KEY-----)")
+const parsePkcs8PrivateKey = async (body: string): Promise<PrivateKey> => {
+	const der = decodePem(body)
+
+	for (const candidate of Pkcs8Algorithms) {
+		const cryptoKey = await importPkcs8(der, candidate.algorithm)
+		if (cryptoKey === undefined) {
+			continue
+		}
+
+		const jwk = await crypto.subtle.exportKey("jwk", cryptoKey)
+		const d = jwkMember(jwk, "d")
+		const x = jwkMember(jwk, "x")
+
+		if (candidate.type === "ed25519") {
+			return {
+				type: "ed25519",
+				publicKey: new PublicKey(P.struct({ type: SSHText, key: SSHBytes }).encode({ type: "ssh-ed25519", key: base64urlnopad.decode(x) })),
+				jwk: { kty: "OKP", crv: "Ed25519", d, x },
+			}
+		}
+
+		const y = jwkMember(jwk, "y")
+		const point = new Uint8Array([0x04, ...base64urlnopad.decode(x), ...base64urlnopad.decode(y)])
+
+		return {
+			type: "ecdsa",
+			curve: candidate.curve,
+			publicKey: new PublicKey(P.struct({ type: SSHText, curve: SSHText, key: SSHBytes }).encode({ type: `ecdsa-sha2-${candidate.curve}`, curve: candidate.curve, key: point })),
+			jwk: { kty: "EC", crv: EcdsaCurves[candidate.curve].namedCurve, d, x, y },
+		}
+	}
+
+	// RSA keys are recognised only to give a clearer error
+	if (await importPkcs8(der, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }) !== undefined) {
+		throw new UnsupportedKeyError("CA key type rsa is not supported, the CA key must be Ed25519 or ECDSA")
 	}
 
+	// WebCrypto does not say why a key could not be imported, so a key of
+	// another type cannot be told apart from one that is corrupt
+	throw new KeyParseError("PKCS#8 private key could not be imported as an Ed25519 or ECDSA (nistp256, nistp384 or nistp521) key")
+}
+
+/**
+ * Parses an unencrypted Ed25519 or ECDSA private key in OpenSSH format, as
+ * created by `ssh-keygen`
+ */
+const parseOpenSshPrivateKey = (body: string): PrivateKey => {
+	const bytes = decodePem(body)
 	let container: P.UnwrapCoder<typeof OpenSshPrivateKey>
 	try {
-		container = OpenSshPrivateKey.decode(base64.decode(match[1]!.replace(/\s+/g, "")))
+		container = OpenSshPrivateKey.decode(bytes)
 	} catch (err) {
 		throw new KeyParseError("private key could not be decoded", err)
 	}
@@ -292,3 +398,30 @@ export const parsePrivateKey = (text: string): PrivateKey => {
 	throw new UnsupportedKeyError(`CA key type ${keyTypeName(start.type)} is not supported, the CA key must be Ed25519 or ECDSA`)
 }
 
+/**
+ * Parses an unencrypted Ed25519 or ECDSA private key, either in OpenSSH
+ * format, as created by `ssh-keygen`, or in PKCS#8 format, as created by
+ * `ssh-keygen -m PKCS8` or `openssl genpkey`
+ *
+ * @param text The private key, starting with `-----BEGIN OPENSSH PRIVATE KEY-----` or `-----BEGIN PRIVATE KEY-----`
+ * @returns The private key. A PKCS#8 key has no comment.
+ * @throws {@link KeyParseError} when the key cannot be parsed or is encrypted
+ * @throws {@link UnsupportedKeyError} when the key is not an Ed25519 or ECDSA key
+ */
+export const parsePrivateKey = async (text: string): Promise<PrivateKey> => {
+	const openssh = /-----BEGIN OPENSSH PRIVATE KEY-----([\s\S]*?)-----END OPENSSH PRIVATE KEY-----/.exec(text)
+	if (openssh?.[1] !== undefined) {
+		return parseOpenSshPrivateKey(openssh[1])
+	}
+
+	const pkcs8 = /-----BEGIN PRIVATE KEY-----([\s\S]*?)-----END PRIVATE KEY-----/.exec(text)
+	if (pkcs8?.[1] !== undefined) {
+		return parsePkcs8PrivateKey(pkcs8[1])
+	}
+
+	if (text.includes("-----BEGIN ENCRYPTED PRIVATE KEY-----")) {
+		throw new KeyParseError("encrypted private keys are not supported")
+	}
+
+	throw new KeyParseError("private key was not in OpenSSH format, as created by ssh-keygen (starting with -----BEGIN OPENSSH PRIVATE KEY-----), or in PKCS#8 format (starting with -----BEGIN PRIVATE KEY-----)")
+}

package/src/types.ts

@@ -89,13 +89,49 @@ export interface CaSecret {
 }
 
 /**
- * The bindings (environment) the CA expects, see {@link CaDatabase} and
- * {@link CaSecret} for the non-string bindings.
+ * A rate limiter, with the same shape as a Cloudflare Workers rate limit
+ * binding.
+ *
+ * A Workers `RateLimit` binding satisfies this structurally. On other
+ * runtimes any limiter with the same shape may be used.
+ */
+export interface CaRateLimiter {
+    /**
+     * Counts a request against the limit for a key
+     *
+     * @param options The key the request is counted against, for example the client IP address
+     * @returns Whether the request is within the limit
+     */
+    limit(options: { key: string }): Promise<{ success: boolean }>
+}
+
+/**
+ * A key-value cache, with the subset of a Cloudflare Workers KV namespace
+ * binding used by the CA.
+ *
+ * A Workers `KVNamespace` binding satisfies this structurally. On other
+ * runtimes any cache with the same shape may be used, such as the in-memory
+ * cache returned by `cacheInMemory` from `@andrewheberle/serverless-ssh-ca/node`.
+ */
+export interface CaCache {
+    /** Returns the value for a key, or null if there is none */
+    get(key: string): Promise<string | null>
+    /** Sets the value for a key, which may expire after `expirationTtl` seconds */
+    put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void>
+}
+
+/**
+ * The bindings (environment) the CA expects, see {@link CaDatabase},
+ * {@link CaSecret}, {@link CaRateLimiter} and {@link CaCache} for the non-string
+ * bindings.
  */
 export interface SshCaBindings {
 	CERTIFICATE_REQUEST_TIME_SKEW_MAX: string
 	JWT_ALGORITHMS: string | string[]
-	JWT_AUD?: string | string[]
+	/** The audience the identity token, and unless {@link SshCaBindings.JWT_ACCESS_TOKEN_AUD} is set the access token, must be issued for */
+	JWT_AUD: string | string[]
+	/** The audience the access token must be issued for, when it differs from {@link SshCaBindings.JWT_AUD} */
+	JWT_ACCESS_TOKEN_AUD?: string | string[]
 	JWT_ISSUER: string
 	JWT_JWKS_URL: string
 	JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string
@@ -104,6 +140,16 @@ export interface SshCaBindings {
     DB: CaDatabase
     ISSUER_DN: string
     PRIVATE_KEY: CaSecret
+    /**
+     * Limits requests to issue, renew and revoke certificates, see
+     * {@link CaRateLimiter}. Requests are not limited when this is not set.
+     */
+    RATE_LIMITER?: CaRateLimiter
+    /**
+     * Caches KRLs until a certificate is revoked, see {@link CaCache}. KRLs
+     * are generated for every request when this is not set.
+     */
+    CACHE?: CaCache
     SSH_CERTIFICATE_EXTENSIONS: string
     SSH_CERTIFICATE_INCLUDE_SELF_EMAIL?: string | boolean
     SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean

package/src/utils.ts

@@ -1,9 +1,9 @@
 import type { SshCaBindings } from "./types.js"
 import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors"
 import { CertificateParseError, SshCertificate } from "./ssh/certificate.js"
-import { KeyParseError, parsePrivateKey, PublicKey, UnsupportedKeyError, type PrivateKey } from "./ssh/keys.js"
+import { KeyParseError, MinimumRsaKeyBits, parsePrivateKey, PublicKey, rsaKeyBits, UnsupportedKeyError, type PrivateKey } from "./ssh/keys.js"
 import z from "zod"
-import { verifyJWT } from "./verify.js"
+import { MissingAudienceError, verifyJWT } from "./verify.js"
 import { CertificateRequestJWTPayload } from "./types.js"
 import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof.js"
 import type { isRevoked as IsRevokedFn } from "./db/index.js"
@@ -56,6 +56,74 @@ type AccessToken = {
 	sub: string
 }
 
+/**
+ * Thrown when a claim of a verified token is missing or is not of the
+ * expected type.
+ */
+export class TokenClaimError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "TokenClaimError"
+
+		Object.setPrototypeOf(this, TokenClaimError.prototype)
+	}
+}
+
+const SubjectClaimSchema = z.string().min(1)
+
+/**
+ * Returns the subject of a verified token, which is compared between the
+ * access and identity tokens so must always be present.
+ *
+ * @param payload The payload of a verified token
+ * @returns The `sub` claim of the token
+ * @throws {@link TokenClaimError} when the `sub` claim is missing, empty or not a string
+ */
+export const tokenSubject = (payload: { sub?: unknown }): string => {
+	const parsed = SubjectClaimSchema.safeParse(payload.sub)
+	if (!parsed.success) {
+		throw new TokenClaimError("JWT was verified but was missing required sub claim")
+	}
+
+	return parsed.data
+}
+
+/**
+ * The claims of an access token that identify the user's email address.
+ *
+ * `email_verified` is optional as not every IdP includes it, but when it is
+ * included it must be true, as an IdP may otherwise issue a token for an
+ * address the user has not shown they control.
+ */
+const EmailClaimsSchema = z.object({
+	email: z.email(),
+	email_verified: z.boolean().optional(),
+})
+
+/**
+ * Returns the email address of a verified access token, or why it cannot be
+ * used.
+ *
+ * @param payload The payload of a verified access token
+ * @returns The email address, or an error message if the claims are not acceptable
+ */
+export const tokenEmail = (payload: Record<string, unknown>): { ok: true, email: string } | { ok: false, error: string } => {
+	if (payload.email === undefined) {
+		return { ok: false, error: "JWT was verified but was missing required email claim" }
+	}
+
+	const parsed = EmailClaimsSchema.safeParse(payload)
+	if (!parsed.success) {
+		return { ok: false, error: "JWT was verified but the email or email_verified claim was not valid" }
+	}
+
+	if (parsed.data.email_verified === false) {
+		return { ok: false, error: "JWT was verified but the email address has not been verified by the IdP" }
+	}
+
+	return { ok: true, email: parsed.data.email }
+}
+
 export const transformAuthorizationHeader = async (env: SshCaBindings, val: string, ctx: z.RefinementCtx): Promise<AccessToken | never> => {
 	if (!val.startsWith("Bearer ") || val.length <= 7) {
 		return fatalIssue(ctx, "authorization header must be a Bearer token", val)
@@ -69,19 +137,28 @@ export const transformAuthorizationHeader = async (env: SshCaBindings, val: stri
 	}
 
 	try {
-		// verify jwt
-		const { payload } = await verifyJWT(env, jwt)
-
-		if (payload.email === undefined) {
-			return fatalIssue(ctx, "JWT was verified but was missing required email claim", val)
+		// verify jwt, which must be issued for this CA
+		const aud = split(env.JWT_ACCESS_TOKEN_AUD).length > 0 ? env.JWT_ACCESS_TOKEN_AUD : env.JWT_AUD
+		const { payload } = await verifyJWT(env, jwt, aud)
+
+		const email = tokenEmail(payload)
+		if (!email.ok) {
+			l.warn(email.error, "in", "transformAuthorizationHeader")
+			return fatalIssue(ctx, email.error, val)
 		}
 
 		return {
-			email: payload.email,
-			sub: payload.sub,
+			email: email.email,
+			sub: tokenSubject(payload),
 		}
 	} catch (err) {
 		switch (true) {
+			case (err instanceof MissingAudienceError):
+				// a misconfigured CA is a server error, not a validation failure
+				l.error(err.message, "in", "transformAuthorizationHeader")
+				throw new InternalServerErrorException(err.message)
+			case (err instanceof TokenClaimError):
+				return fatalIssue(ctx, err.message, val)
 			case (err instanceof JWSInvalid):
 				return fatalIssue(ctx, "the access token was invalid", val)
 			case (err instanceof JWTInvalid):
@@ -145,6 +222,36 @@ export const transformPublicKey = (val: string | Buffer<ArrayBufferLike>, ctx: z
 	}
 }
 
+/**
+ * Returns why a public key cannot be issued a certificate, or undefined if it
+ * can be.
+ *
+ * RSA keys must be at least {@link MinimumRsaKeyBits} bits, as smaller keys
+ * can be factored and are refused by current OpenSSH releases.
+ *
+ * @param key The public key a certificate would be issued for
+ * @returns The reason the key cannot be used, or undefined if it can be
+ */
+export const subjectKeyIssue = (key: PublicKey): string | undefined => {
+	const bits = rsaKeyBits(key)
+	if (bits !== undefined && bits < MinimumRsaKeyBits) {
+		return `RSA keys must be at least ${MinimumRsaKeyBits} bits, not ${bits}`
+	}
+
+	return undefined
+}
+
+/**
+ * Refines a public key so only one allowed by {@link subjectKeyIssue} is
+ * accepted for a certificate request.
+ */
+export const refineSubjectKey = (val: PublicKey, ctx: z.RefinementCtx): void => {
+	const issue = subjectKeyIssue(val)
+	if (issue !== undefined) {
+		fatalIssue(ctx, issue, val.toString())
+	}
+}
+
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -210,13 +317,13 @@ export const parseIdentity = async (env: SshCaBindings, jwt: string | undefined,
 		throw new Error("missing identity token")
 	}
 
-	const aud = split(env.JWT_AUD)
-	const { payload } = await verifyJWT(env, jwt, { aud: aud.length === 0 ? undefined : aud })
+	const { payload } = await verifyJWT(env, jwt, env.JWT_AUD)
 
+	const sub = tokenSubject(payload)
 	const principals = identityPrincipals(env, payload, claim)
 
 	return {
-		sub: payload.sub,
+		sub: sub,
 		principals: principals,
 	}
 }
@@ -227,9 +334,14 @@ export const transformIdentityToken = async (env: SshCaBindings, val: string, ct
 
 		return identity
 	} catch (err) {
+		// a misconfigured CA is a server error, not a validation failure
+		if (err instanceof MissingAudienceError) {
+			logger(env).error(err.message, "in", "transformIdentityToken")
+			throw new InternalServerErrorException(err.message)
+		}
 		ctx.issues.push({
 			code: "custom",
-			message: err instanceof PrincipalsClaimError ? err.message : "problem parsing identity token",
+			message: err instanceof PrincipalsClaimError || err instanceof TokenClaimError ? err.message : "problem parsing identity token",
 			input: val
 		})
 		return z.NEVER
@@ -356,6 +468,51 @@ export const refineHostCertificateRequest = async (env: SshCaBindings, val: Pars
 	}
 }
 
+// characters that OpenSSH treats as pattern syntax when matching host
+// certificate principals, or that separate entries in a pattern list
+const HostPrincipalPatternChars = /[*?!,]/
+// whitespace and control characters, which no host name contains
+const HostPrincipalInvalidChars = /[\s\p{Cc}]/u
+
+/**
+ * Returns why a principal cannot be included on a host certificate, or
+ * undefined if it can be.
+ *
+ * OpenSSH matches the principals of a host certificate as patterns, so a
+ * principal such as `*` would make the certificate valid for every host that
+ * trusts the CA. Principals are otherwise not restricted, as hosts may be
+ * reached by IP address, bare host name or fully qualified domain name.
+ *
+ * @param principal The principal to check
+ * @returns The reason the principal cannot be used, or undefined if it can be
+ */
+export const hostPrincipalIssue = (principal: string): string | undefined => {
+	if (principal === "") {
+		return "host certificate principals must not be empty"
+	}
+
+	if (HostPrincipalPatternChars.test(principal)) {
+		return `host certificate principal ${JSON.stringify(principal)} must not contain wildcard or pattern characters (*, ?, ! or ,)`
+	}
+
+	if (HostPrincipalInvalidChars.test(principal)) {
+		return `host certificate principal ${JSON.stringify(principal)} must not contain whitespace or control characters`
+	}
+
+	return undefined
+}
+
+/**
+ * Refines a host certificate principal so only one allowed by
+ * {@link hostPrincipalIssue} is accepted.
+ */
+export const refineHostPrincipal = (val: string, ctx: z.RefinementCtx): void => {
+	const issue = hostPrincipalIssue(val)
+	if (issue !== undefined) {
+		fatalIssue(ctx, issue, val)
+	}
+}
+
 type ParsedHostCertificateRenewal = {
 	certificate: SshCertificate
 	proof: RenewalProofOfPossession
@@ -363,7 +520,8 @@ type ParsedHostCertificateRenewal = {
 
 /**
  * Checks a certificate presented for renewal was issued by this CA, is a host
- * certificate, is within its validity period and has not been revoked.
+ * certificate whose principals are allowed (see {@link hostPrincipalIssue}),
+ * is within its validity period and has not been revoked.
  *
  * @param env The CA bindings
  * @param isRevoked Returns whether a serial has been revoked
@@ -384,6 +542,22 @@ export const checkRenewableCertificate = async (env: SshCaBindings, isRevoked: t
 		return "the provided certificate is not a host certificate"
 	}
 
+	// a certificate issued before small RSA keys were refused must not be
+	// renewed, as the renewal would keep its key
+	const keyIssue = subjectKeyIssue(certificate.publicKey)
+	if (keyIssue !== undefined) {
+		return `the provided certificate cannot be renewed: ${keyIssue}`
+	}
+
+	// a certificate issued before wildcard principals were refused must not
+	// be renewed, as the renewal would keep its principals
+	for (const principal of certificate.principals) {
+		const issue = hostPrincipalIssue(principal)
+		if (issue !== undefined) {
+			return `the provided certificate cannot be renewed: ${issue}`
+		}
+	}
+
 	// check certificate is within its validity period, allowing for clock
 	// skew at the start as a certificate issued moments ago may have a
 	// validity start up to a second in the future

package/src/verify.ts

@@ -3,23 +3,63 @@ import { CertificateRequestJWTPayload } from "./types.js"
 import type { SshCaBindings } from "./types.js"
 import { split } from "./utils.js"
 
-type VerifyOptions = {
-	aud?: string | string[]
+/**
+ * Thrown when no audience is configured for a token, as a token issued for
+ * any client of the IdP would otherwise be accepted.
+ */
+export class MissingAudienceError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "MissingAudienceError"
+
+		Object.setPrototypeOf(this, MissingAudienceError.prototype)
+	}
 }
 
-export const verifyJWT = async (env: SshCaBindings, jwt: string, opts: VerifyOptions = {}) => {
-    const JWKS = createRemoteJWKSet(new URL(env.JWT_JWKS_URL))
+type RemoteJWKSet = ReturnType<typeof createRemoteJWKSet>
+
+// the remote JWKS for each URL, kept between requests so the keys that jose
+// caches are reused rather than fetched again for every token
+const remoteJWKSets = new Map<string, RemoteJWKSet>()
+
+/**
+ * Returns the remote JWKS for a URL, creating it on first use.
+ *
+ * jose caches the keys it fetches for up to 10 minutes and fetches them again
+ * sooner when a token is signed with a key it does not have, so keys rotated
+ * by the IdP are still picked up.
+ *
+ * @param url The URL of the JWKS
+ * @returns The remote JWKS for the URL
+ */
+const remoteJWKSet = (url: string): RemoteJWKSet => {
+	let jwks = remoteJWKSets.get(url)
+	if (jwks === undefined) {
+		jwks = createRemoteJWKSet(new URL(url))
+		remoteJWKSets.set(url, jwks)
+	}
+
+	return jwks
+}
 
-	if (opts.aud !== undefined) {
-		return await jwtVerify<CertificateRequestJWTPayload>(jwt, JWKS, {
-			issuer: env.JWT_ISSUER,
-			algorithms: split(env.JWT_ALGORITHMS),
-			audience: opts.aud
-		})
+/**
+ * Verifies a JWT from the IdP, including that it was issued for one of the
+ * audiences given.
+ *
+ * @param env The CA bindings
+ * @param jwt The JWT to verify
+ * @param aud The audiences the JWT may be issued for, which must not be empty
+ * @throws {@link MissingAudienceError} when no audience is given
+ */
+export const verifyJWT = async (env: SshCaBindings, jwt: string, aud: string | string[] | undefined) => {
+	const audience = split(aud)
+	if (audience.length === 0) {
+		throw new MissingAudienceError("no audience is configured for verifying tokens, set JWT_AUD")
 	}
 
-    return await jwtVerify<CertificateRequestJWTPayload>(jwt, JWKS, {
-        issuer: env.JWT_ISSUER,
-        algorithms: split(env.JWT_ALGORITHMS),
-    })
+	return await jwtVerify<CertificateRequestJWTPayload>(jwt, remoteJWKSet(env.JWT_JWKS_URL), {
+		issuer: env.JWT_ISSUER,
+		algorithms: split(env.JWT_ALGORITHMS),
+		audience: audience,
+	})
 }