SSH Certificates: A Better SSH Experience Beyond Passwords and Keys

A detailed technical guide by Jan-Piet Mens explores SSH certificates as a superior alternative to traditional SSH key management, addressing the fundamental weaknesses of the Trust-on-First-Use (TOFU) model.

The Problem with TOFU

When you SSH into a server for the first time, you're asked to verify its fingerprint. Most users blindly type 'yes' — making SSH's security model effectively dependent on the hope that nothing has intercepted the connection.

What SSH Certificates Provide

SSH certificates solve this by introducing a Certificate Authority (CA) model:

• Server certificates: CA signs host keys, eliminating manual fingerprint verification
• User certificates: CA signs user keys, eliminating the need for authorized_keys management
• Short-lived certificates: Automatic expiration limits damage from compromised keys
• Principals and extensions: Fine-grained access control built into certificates

Practical Benefits

1. No more TOFU prompts: Certificate verification replaces trust-on-first-use
2. Centralized key management: Add/remove access by issuing/revoking certificates
3. Audit trail: Certificate issuance and usage can be logged
4. Scalable: Works for organizations managing hundreds or thousands of servers

Implementation

The guide covers setting up an SSH CA using step-ca (Smallstep's certificate authority) and practical configuration for both servers and clients.

Why This Matters

As organizations scale their infrastructure, SSH certificate-based authentication becomes essential for security compliance, access management, and operational efficiency. The shift from ad-hoc key management to certificate-based systems represents a maturation of infrastructure security practices.