4 ms·
And what about the CA?
by namibj 6mo ago
And what about the CA?
- cyberax 6mo agoIt's no different compared to regular SSH private keys. You need to protect it from compromise. However, it provides you an additional layer of protection, because it does not need to be on the critical path for every SSH connection. My CA is a Nitrokey HSM, for example. I issue myself temporary certs that are valid only for 6 hours for ephemeral private keys.
- otabdeveloper4 6mo agoYes it is different. SSH CA keys are harder to secure and attackers have a much bigger incentive to steal them.
- _bernd 6mo agoYou can also configure multiple CA for client auth, and on the client side multiple ca to verify host keys.