SSH certificates: the better SSH experience

Re:SSH certificates: the better SSH experience by cyberax on Friday April 03, 2026 @01:43PM (#47629683)

> With SSH certificates you have to go back to the "keys to the kingdom" antipattern and just hope for the best.

Whut? This is literally the opposite.

With CA certs you can create short-lived certificates, so you can easily grant access to a system for a short time.

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by namibj on Friday April 03, 2026 @03:10PM (#47630799)

And what about the CA?

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by cyberax on Friday April 03, 2026 @03:46PM (#47631294)

It's no different compared to regular SSH private keys. You need to protect it from compromise.

However, it provides you an additional layer of protection, because it does not need to be on the critical path for every SSH connection. My CA is a Nitrokey HSM, for example. I issue myself temporary certs that are valid only for 6 hours for ephemeral private keys.

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by otabdeveloper4 on Sunday April 05, 2026 @05:37AM (#47647684)

Yes it is different. SSH CA keys are harder to secure and attackers have a much bigger incentive to steal them.

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by _bernd on Friday April 03, 2026 @07:10PM (#47633538)

You can also configure multiple CA for client auth, and on the client side multiple ca to verify host keys.

[ Parent | on HN ]