How often should I rotate my SSH keys?

Re:How often should I rotate my SSH keys? by _n_b_ on Friday February 26, 2021 @06:11AM (#26273581)

> how you protect the signing certificates

You get an HSM like this: https://www.veritech.net/product-detail/keyper-hsm/ that stays air-gapped.

Then you build procedures around it, like https://www.iana.org/dnssec

Not cheap or easy.

[ Parent | on HN ]

Re:How often should I rotate my SSH keys? by foolmeonce on Friday February 26, 2021 @08:02AM (#26274327)

If you have no compliance requirements, you can also just use any pkcs#11 token (with support for non-extractable keys) to secure the key, and setup an air-gapped process on a laptop with a bootcd, etc, to minimize the risk of compromising your process.

[ Parent | on HN ]