4 ms·

The certs are just an alternative to managing the authorized_keys server-side. That's it. What you said about MFA and not getting long-term secrets is some extr

The certs are just an alternative to managing the authorized_keys server-side. That's it. What you said about MFA and not getting long-term secrets is some extra thing on top of it and not invalidating your parents point.

tptacek 4y ago
No, that's not true. SSH keys are long-lived secrets, and certificates often deliberately aren't.
- blueflow 4y ago
  This is not what it is, this is how you specifically use them.
  - tptacek 4y ago
    I understand what you're trying to say, but "The certs are just an alternative to managing the authorized_keys server-side" is just not correct. Certs can do things plain authorized_keys can't.