Re:If you’re not using SSH certificates you’re doing SSH wro...
by OrvalWintermute on Thursday March 24, 2022 @01:52PM
(#30793256)
It sounds like you could be making the rookie mistake instead by not reading what he/she actually wrote.
> Yeah the lack of mentioning a CRL at all really stood out when reading this. I actually didn't know about SSH certificates until I saw this article (I always assumed that SSH did not support this), but do run my own CA and authentication for internal web services, EAP-TLS, and VPN. The CRL is your first line of defense in the sense that it blocks the use of that credential instantly when it is revoked.
This sounds like he/she is running an x509 CA. He/she is generating certs for various use-cases.
It is possible to use x509 certs with SSH of course, and so he/she could leverage his/her pre-existing CA for that function.
Given above context CRL is completely accurate. And, KRL is not.
> Yeah the lack of mentioning a CRL at all really stood out when reading this. I actually didn't know about SSH certificates until I saw this article (I always assumed that SSH did not support this), but do run my own CA and authentication for internal web services, EAP-TLS, and VPN. The CRL is your first line of defense in the sense that it blocks the use of that credential instantly when it is revoked.
This sounds like he/she is running an x509 CA. He/she is generating certs for various use-cases.
It is possible to use x509 certs with SSH of course, and so he/she could leverage his/her pre-existing CA for that function.
Given above context CRL is completely accurate. And, KRL is not.