Re:If you’re not using SSH certificates you’re doing SSH wro...
by yosamino on Thursday March 24, 2022 @11:29AM
(#30791253)
One example also mentioned in the article:
If you connect to a ssh-server for the first time, ssh will give you a warning and let you know that you have to verify the fingerprint of the host key.
This becomes annoying when you connect to many different servers and I would not trust everyone (including me) to do this check correctly every single time.
SSH certificates solve this by having the ssh-host-key be signed in a way that your ssh-client can verify and you only have to add a key-signing-key to you known_hosts once.
Now you have to sign the ssh-host-key but you only have to do it once per server as opposed to having each user having to do it locally on every first connect.
If you connect to a ssh-server for the first time, ssh will give you a warning and let you know that you have to verify the fingerprint of the host key.
This becomes annoying when you connect to many different servers and I would not trust everyone (including me) to do this check correctly every single time.
SSH certificates solve this by having the ssh-host-key be signed in a way that your ssh-client can verify and you only have to add a key-signing-key to you known_hosts once.
Now you have to sign the ssh-host-key but you only have to do it once per server as opposed to having each user having to do it locally on every first connect.