Yo Motherboard

Managing SSH Access at Scale: Certificates vs. Keys

April 29, 2025 6 answers
Asked by CuriousDev123
I'm really curious about how others are handling SSH access for large teams. We recently published a blog post discussing the limitations of using SSH public key authentication, especially in high-paced environments where issues like key sprawl and unclear access management can become significant headaches. The article proposes that SSH certificates could serve as a more scalable and secure alternative to public keys, similar to the approach used in modern identity systems that offer short-lived credentials. I'm interested in hearing from the community: Are any of you utilizing SSH certificates in a production setting? What tools or workflows do you use for issuing, rotating, and revoking these certificates? Also, if you're still relying on static keys, what are the challenges you're facing when considering a switch?
access management Blog certificates DevOps Security SSH

Answers

CloudyTechie
I'm curious about how this setup would integrate with PIV certificates. If SSH tunnels could be established with PIV certs, that could streamline a lot of processes.

OldSchoolAdmin: Same! I hope this simplifies things; I've always seen PIV used for different purposes.

PKI_Expert: While PIV certificates are likely X.509, OpenSSH supports a simpler format. There are patches that might help if you want to explore using PIVs.

Reply to this answer
LegacySupporter
I still use SSH keys for some projects, and configuration management tools like Ansible make it straightforward. I prefer SSH over SSM for AWS-oriented tasks!
Reply to this answer
SkepticalSysAdmin
I think SSH certs might add more complexity than using bastion hosts, which can already scale well for access management. Why not just manage access through bastions?

TechChallenger: With SSH certificates, a new user just needs certificate request permission, and you skip individual server updates, making it more manageable.

QuestioningIT2: But some argue bastion setups can handle thousands of users effectively, managing a centralized entry point for security.

Reply to this answer
SSH_Bob
I'm still using SSH keys. Do SSH certificates work like SSL/TLS certs? Do I need to use a service like DigiCert, or can I self-sign them?

AnsibleNinja: I've always self-signed my keys. I'm curious if others do the same.

CodeMaster88: Yes, they have a different format but generally function similarly to SSL/TLS certs. You'll set up a PKI infrastructure, so your root CA will be self-signed, and the keys users authenticate with are signed by your CA.

Reply to this answer
TechieGuru99
I noticed you skipped discussing the challenges around revoking and cycling out expired CAs, which can be tricky when dealing with OpenSSH's X.509 implementation.

QuestionCrafter22: Do you have resources that dive deeper into this? I know that in X.509, a root CA can't be revoked by default. SSH certs differ a bit since they don't use X.509 format, but I'd love to understand more.

CyberSecGeek33: Check out discussions from u/divad1196; they make solid points about the differences between SSH certificates and X.509 certificates, especially about CA hierarchies.

Reply to this answer
OIDC_Fanboy
We now use OIDC, and OPKSSH has been incredibly scalable for our enterprise needs.

DevOpsDude2023: How do you handle user and group management across multiple servers? Do you need to install OPKSSH on each server and manage users manually?

TechExplorer: Thanks for the recommendation! This tool looks perfect for what I've been searching for.

Reply to this answer

Add your answer

Answers are reviewed before publication.

Related Discussions