For SSH: I'm a fan of public key distribution via directory service (LDAP) with failover/caching via sssd. Private key storage on a smartcard (Yubikey in my ca

For SSH: I'm a fan of public key distribution via directory service (LDAP) with failover/caching via sssd. Private key storage on a smartcard (Yubikey in my case) SSL: It depends on where it's being deployed -- AWS apps use ACM, situations where I need to access the secret from within a running system image (gce/ec2) generally uses the platform's kms long with their object store. Can't help but notice this account only has two posts, both asking about commercial solutions folks use for secret management. I'm gonna take a stab in the dark and say this is market research?