Poll HN: Do you use SSH certificates (not mere public-key authentication)?

Re:Poll HN: Do you use SSH certificates (not mere public-key... by bongobingo1 on Wednesday August 31, 2022 @02:14PM (#32666153)

I think,

1) You don't have to ssh-copy-id to new boxes, which is nice.

2) You can de-auth a key for all machines by changing the DNS record. This would depend on some propagation time but perhaps you can point the resolver at your nameserver directly which would avoid that.

[ Parent | on HN ]

Re:Poll HN: Do you use SSH certificates (not mere public-key... by chociej on Wednesday August 31, 2022 @04:01PM (#32667591)

You could simply choose a short TTL, or your tool could check for e.g. "some-name._sshkeys.whatever.tld" as well as "_revoked.some-name._sshkeys.whatever.tld" to handle revocation instantly

[ Parent | on HN ]

Re:Poll HN: Do you use SSH certificates (not mere public-key... by bongobingo1 on Thursday September 01, 2022 @05:17AM (#32673947)

You could also just stick it behind a https GET and probably skip a bunch of bother.

[ Parent | on HN ]

Re:Poll HN: Do you use SSH certificates (not mere public-key... by xorcist on Friday September 02, 2022 @07:53AM (#32689519)

Now you've just moved your authentication to the SSL PKI.

In that case, use the SSL certs directly. You'd have add support OpenSSH of course, or just convert the certificates to SSH format, but it would be architecturally much simpler.

As to the original question here, the benefit compared to other PKI alternatives (including the SSH PKI in the original question) is that revocation is much easier.

[ Parent | on HN ]