4 ms·
Certificates have a private key and a public key, and you keep the private key secret and move the public key around, so ... how is that different, technically
by jodrellblank 2y ago
Certificates have a private key and a public key, and you keep the private key secret and move the public key around, so ... how is that different, technically and organizationally?
What do you actually do, and how is it better?
- push0ret 2y ago[dead]
- jyounker 2y agoThere is only one public key that installed on the servers. That key is the same everywhere. You have a self-serve system that generates short-lived certs to users.
- SoftTalker 2y agoYou can put the a regular SSH public key in LDAP, that’s pretty widely supported.
- jodrellblank 2y agoCan you be more specific? What public key is installed where on the servers? What self-serve system where generating certs how and in what form do users get them and what do they do with them? And how is the user authenticating to the self-serve system - username/password? And why can't they just do that to the SSH server?
- m-a-r-c-e-l 2y agoHey, have a look at this https://smallstep.com/blog/use-ssh-certificates/ https://smallstep.com/blog/use-ssh-certificates/
- ianburrell 2y agoThe company certificate is put on the server. Manually, the sysadmin generates the user key signed by certificate and sends it to them. Or the self-serve system generates it and they download it. The user uses the SSH key as normal. The server checks that if key is signed. The self-serve system uses the single-sign-on system for the company. The SSH server can't do SSO, maybe can do LDAP, but it is giant annoyance to set it up. A lot SSH use assumes that using key and doesn't support username/password.