3 ms·

You've not seen that? It's HostCertificate in sshd_config. Then in known_hosts: @cert-authority *.example.com ssh-rsa AAAAB… https://www.digitalocean.com/com

by knorker 10y ago

You've not seen that? It's HostCertificate in sshd_config. Then in known_hosts: @cert-authority *.example.com ssh-rsa AAAAB… https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu https://www.digitalocean.com/community/tutorials/how-to-crea... Edit: Oh, you mean for making them more short lived.

mcpherrinm 10y ago
You can trust a CA easily enough. So do you just glob some shell scripts around ssh-keygen? Short-lived is one solution to limiting their lifetime: the other is to use a CRL format. Either way, you need software to manage the issuance and later revocation. I suppose you could build this into your host imaging profile, or use config management software. I'm just interested in what people do.