4 ms·
It's possible to store the private CA keys on something like YubiKey hardware offline. That seems like a good trade off if you don't have access to a cloud base
by onetimeusename 4y ago
It's possible to store the private CA keys on something like YubiKey hardware offline. That seems like a good trade off if you don't have access to a cloud based HSM. Ideally, the private CA keys would be stored in an HSM and used to sign any keys you needed with them. Note: this is not to be confused with using a FIDO/U2F hardware authenticators which is also a good idea.
This can double not only has a PKI for hosts and users using SSH connections but you can also use the PKI for signature verification of arbitrary data.