SSH Certificates

Beyond raw keys: signed certificates

SSH certificates let a Certificate Authority (CA) sign user and host keys, embedding identity ("principal"), scope, and an expiration date. Instead of distributing public keys to every ~/.ssh/authorized_keys on every server, every server trusts the CA's public key — and any user with a CA-signed certificate can log in.

Why it scales better than authorized_keys

Expiration — certificates auto-expire, no manual rotation needed. Issue a 30-day cert, server stops trusting it after 30 days, period.
Identity in the cert — "this cert is for principal you_username" — server matches against allowed users.
Single trust point — one CA public key on every server, instead of N user keys per server.
Revocation by KRL — Key Revocation List can invalidate specific certs before expiration.

Code

Set up a CA and sign a user key·bash

# Generate the CA key pair (do this ONCE, protect the CA private key like gold)
ssh-keygen -t ed25519 -f ca_key -C 'Fleet CA'

# Sign a user's public key
ssh-keygen -s ca_key \
    -I 'you_username@office-2026' \
    -n you_username \
    -V +52w \
    ~/.ssh/id_ed25519.pub

# This produces: ~/.ssh/id_ed25519-cert.pub
# -s  CA private key (signing)
# -I  identity / cert serial (shows in logs)
# -n  principals (which usernames this cert can log in as)
# -V  validity window (+52w = expires in 52 weeks)

Trust the CA on every server·bash

# Copy the CA PUBLIC key to each server (NOT the private key — that stays on the CA host)
scp ca_key.pub server:/tmp/

# On the server
sudo mv /tmp/ca_key.pub /etc/ssh/ca_key.pub
sudo chown root:root /etc/ssh/ca_key.pub
sudo chmod 644 /etc/ssh/ca_key.pub

# Tell sshd to trust certificates signed by it
echo 'TrustedUserCAKeys /etc/ssh/ca_key.pub' | \
    sudo tee -a /etc/ssh/sshd_config
sudo sshd -t
sudo systemctl restart sshd

# Verify a cert
ssh-keygen -L -f ~/.ssh/id_ed25519-cert.pub

Exercise

Set up an SSH CA on a separate machine (not your daily laptop). Sign your laptop's ~/.ssh/id_ed25519.pub with -V +1d (1 day validity). Trust the CA on one test server. SSH to it — should work without authorized_keys having your key listed. Wait an hour, run ssh-keygen -L -f on the cert to see the validity window. Tomorrow, retry — should fail (cert expired). That's the auto-rotation property in action.

Beyond raw keys: signed certificates

Why it scales better than authorized_keys

Code

External links

Exercise

Progress

Comments 0