4 ms·

You can already use certificates to login via SSH. Usually you setup your own certificate authority and sign your own certs because they need special attributes

by sargun 3y ago

You can already use certificates to login via SSH. Usually you setup your own certificate authority and sign your own certs because they need special attributes.

adontz 3y ago
SSH certificates (I encourage using them!) are not x509, absolutely incompatible.
- dilyevsky 3y ago
  It’s same general principle and same security model just different way of going about it. It supports CAs and extensions just like x509
  - adontz 3y ago
    No. For instance SSH certificates are one level only, do not support trust chains, cross signing, and a lot of other x509 complexity.
- ReK_ 3y ago
  You're thinking of SSH keys, which are not certificates. SSH certificates are indeed x.509: https://datatracker.ietf.org/doc/html/rfc6187 https://datatracker.ietf.org/doc/html/rfc6187
  - adontz 3y ago
    No, I'm thinking of SSH certificates. Here is the description of file format, it's nothing like x509 https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys https://github.com/openssh/openssh-portable/blob/master/PROT...