If You’re Not Using SSH Certificates You’re Doing SSH Wrong
summary
Argues that simple public‑key SSH is the operational and security problem and that switching to certificate auth fixes it: OpenSSH added certificates in OpenSSH 5.4 ten years ago, large sites like Facebook, Uber, Netflix use them, and certificates remove TOFU, simplify onboarding, and let keys be ephemeral SSH certificates issued via SSO. Demonstrates a flow using a proxy command plus browser SSO, ssh-agent, and a CA (examples: SSH keygen, Netflix bless, Vault SSH engine, and smallstep’s step CA/step CLI) that automatically issues short‑lived host and user certs.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker intro
- 1:27Problems with SSH deployments
- 3:54Trust on First Use risks
- 5:40Why SSH certificates solve issues
- 7:06Tools for SSH certificate auth
- 8:10Demo of ideal SSH flow
- 9:55Obstacles and conclusion
related talks
41mA better way to SSH: Introducing SSH certificates
32mKeys or Certs for SSH Access? Why should I care?
29mSSH Certificates: a way to scale SSH access
44mEngineering Secure SSH Access for Engineers
45mZero Trust SSH
23mAutomation with Scalable & Secure SSH- 44mEngineering Secure SSH Access for Engineers
28mManaging SSH Access without Managing SSH Keys