feat: add cert fingerprint to issuance log, remove connection hash

The cert fingerprint matches what 'epithet agent inspect' displays,
enabling direct correlation. The connection hash (%C) is not meaningful
on the CA side so it is removed from the log output.

Author: brianm

pkg/caserver/caserver.go

@@ -2,6 +2,8 @@ package caserver
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -349,6 +351,9 @@ func (s *caServer) logCertIssuance(
 		return fmt.Errorf("failed to generate fingerprint: %w", err)
 	}
 
+	// Cert fingerprint matches what `epithet agent inspect` displays.
+	certFP := "SHA256:" + base64.RawStdEncoding.EncodeToString(sha256Sum(parsedCert.Marshal()))
+
 	event := &CertEvent{
 		Timestamp:            time.Now(),
 		SerialNumber:         fmt.Sprintf("%d", parsedCert.Serial),
@@ -358,6 +363,7 @@ func (s *caServer) logCertIssuance(
 		ValidAfter:           time.Unix(int64(parsedCert.ValidAfter), 0),
 		ValidBefore:          time.Unix(int64(parsedCert.ValidBefore), 0),
 		Extensions:           policyResp.CertParams.Extensions,
+		CertFingerprint:      certFP,
 		PublicKeyFingerprint: fingerprint,
 		Policy:               policyResp.Policy,
 	}
@@ -389,3 +395,8 @@ func generateFingerprint(pubKey sshcert.RawPublicKey) (string, error) {
 
 	return ssh.FingerprintSHA256(key), nil
 }
+
+func sha256Sum(data []byte) []byte {
+	h := sha256.Sum256(data)
+	return h[:]
+}

pkg/caserver/logger.go

@@ -25,6 +25,7 @@ type CertEvent struct {
 	ValidAfter           time.Time
 	ValidBefore          time.Time
 	Extensions           map[string]string
+	CertFingerprint      string
 	PublicKeyFingerprint string
 	Policy               policy.Policy
 }
@@ -49,11 +50,11 @@ func (l *SlogCertLogger) LogCert(ctx context.Context, event *CertEvent) error {
 		slog.String("remote_host", event.Connection.RemoteHost),
 		slog.String("remote_user", event.Connection.RemoteUser),
 		slog.Int("port", int(event.Connection.Port)),
-		slog.String("hash", string(event.Connection.Hash)),
 		slog.String("proxy_jump", event.Connection.ProxyJump),
 		slog.Time("valid_after", event.ValidAfter),
 		slog.Time("valid_before", event.ValidBefore),
 		slog.Any("extensions", event.Extensions),
+		slog.String("cert_fingerprint", event.CertFingerprint),
 		slog.String("public_key_fingerprint", event.PublicKeyFingerprint),
 		slog.Any("host_users", event.Policy.HostUsers),
 	)
@@ -109,11 +110,11 @@ type certEventForJSON struct {
 	RemoteHost           string              `json:"remote_host"`
 	RemoteUser           string              `json:"remote_user"`
 	Port                 int                 `json:"port"`
-	Hash                 string              `json:"hash"`
 	ProxyJump            string              `json:"proxy_jump,omitempty"`
 	ValidAfter           time.Time           `json:"valid_after"`
 	ValidBefore          time.Time           `json:"valid_before"`
 	Extensions           map[string]string   `json:"extensions,omitempty"`
+	CertFingerprint      string              `json:"cert_fingerprint"`
 	PublicKeyFingerprint string              `json:"public_key_fingerprint"`
 	HostUsers            map[string][]string `json:"host_users"`
 }
@@ -128,11 +129,11 @@ func (e *CertEvent) toJSON() ([]byte, error) {
 		RemoteHost:           e.Connection.RemoteHost,
 		RemoteUser:           e.Connection.RemoteUser,
 		Port:                 int(e.Connection.Port),
-		Hash:                 string(e.Connection.Hash),
 		ProxyJump:            e.Connection.ProxyJump,
 		ValidAfter:           e.ValidAfter,
 		ValidBefore:          e.ValidBefore,
 		Extensions:           e.Extensions,
+		CertFingerprint:      e.CertFingerprint,
 		PublicKeyFingerprint: e.PublicKeyFingerprint,
 		HostUsers:            e.Policy.HostUsers,
 	}

pkg/caserver/logger_test.go

@@ -219,9 +219,6 @@ func TestCertEvent_toJSON(t *testing.T) {
 	if parsed.Port != 22 {
 		t.Errorf("Expected port=22, got %d", parsed.Port)
 	}
-	if parsed.Hash != "abc123" {
-		t.Errorf("Expected hash=abc123, got %s", parsed.Hash)
-	}
 	if parsed.ProxyJump != "bastion.example.com" {
 		t.Errorf("Expected proxy_jump=bastion.example.com, got %s", parsed.ProxyJump)
 	}