4 ms·

What's the difference between a certificate and a public/private keys?

• tfigment 4y ago
  You add the intermediate key to config for trust. You do not need authorized_keys files for each user. Good for team and central management and faster key rotation but then needs trusted intermediate authority which is secure. No password or key rotation on machine itself which is good if you have a lot of machines.
• sofixa 4y ago
  Certificate is short lived and signed on the fly for when you need it. The server trusts your SSH CA, and you can ask it to sign any private key you want, with a ttl. So you get extra security (credentials are dynamic and short -lived, and also per-user if needed) and lower maintenance because you only have the SSH CA public key to setup on all machines and that one needs less rotation/updates than public keys.
  • hawski 4y ago
    But then don't you need to maintain this CA certificate? I guess it makes sense for wider centralized access.
  • thayne 4y ago
    A certificate doesn't necessarily have to be short lived, although in practice they usually are. The main difference is that with an ssh key, you install the public key directly on the target host. With a certificate, you Just tell the host to trust a CA, and use that CA to sign client certificates.
  • goodpoint 4y ago
    > lower maintenance because you only have the SSH CA public key to setup on all machines This is hardly "lower maintenance" than pushing updates to the authorized_keys across servers. Or having servers poll for such file.