3 ms·
Certificate is short lived and signed on the fly for when you need it. The server trusts your SSH CA, and you can ask it to sign any private key you want, with
by sofixa 4y ago
Certificate is short lived and signed on the fly for when you need it. The server trusts your SSH CA, and you can ask it to sign any private key you want, with a ttl.
So you get extra security (credentials are dynamic and short -lived, and also per-user if needed) and lower maintenance because you only have the SSH CA public key to setup on all machines and that one needs less rotation/updates than public keys.
- hawski 4y agoBut then don't you need to maintain this CA certificate? I guess it makes sense for wider centralized access.
- thayne 4y agoA certificate doesn't necessarily have to be short lived, although in practice they usually are. The main difference is that with an ssh key, you install the public key directly on the target host. With a certificate, you Just tell the host to trust a CA, and use that CA to sign client certificates.
- goodpoint 4y ago> lower maintenance because you only have the SSH CA public key to setup on all machines This is hardly "lower maintenance" than pushing updates to the authorized_keys across servers. Or having servers poll for such file.