>so I've been working on extending our support for hardware-backed SSH certificates to Windows Interesting work & I wish him luck. The ability to use hardware

>so I've been working on extending our support for hardware-backed SSH certificates to Windows Interesting work & I wish him luck. The ability to use hardware SSH certs on Windows has been around for at least a decade now, but it hasn't been a seamless experience. The other attempt I'm aware of is PuTTY-CAC[0]. It is recommended[1] for security-conscious organizations, and approved for use at places like the US Department of Veteran Affairs[2]. Vendors[3] of smart cards also show some limited support for it. The issue with PuTTY-CAC is that the server still needs to be configured to check the certificate against CRLs & PKI infrastructure. Over the past decade, I believe Red Hat has made some significant progress towards a workable solution[4], however, I have no experience with it. [0] https://github.com/NoMoreFood/putty-cac https://github.com/NoMoreFood/putty-cac [1] https://playbooks.idmanagement.gov/piv/engineer/ssh/ https://playbooks.idmanagement.gov/piv/engineer/ssh/ [2] https://www.oit.va.gov/Services/TRM/ToolPage.aspx?tid=8714# https://www.oit.va.gov/Services/TRM/ToolPage.aspx?tid=8714# [3] https://pivkey.zendesk.com/hc/en-us/articles/207698876-PIVKey-and-PuTTY-CAC-for-SSH-on-Windows https://pivkey.zendesk.com/hc/en-us/articles/207698876-PIVKe... [4] https://en.m.wikipedia.org/wiki/FreeIPA https://en.m.wikipedia.org/wiki/FreeIPA