OpenSSH Host Certificates Replace Per-Host Key Pinning

Wed, 23 Sep 2026 00:00:00 +0000

OpenSSH Host Certificates Replace Per-Host Key Pinning

SSH host authentication protects a client from silently accepting a different server key for a name it intended to reach. The familiar known_hosts model can pin a key directly to a host. That model is simple, but operating it across a large fleet creates a distribution problem: new hosts need trusted entries, planned key rotation changes pins, and stale entries can survive after infrastructure changes.

SSHFP Publishes SSH Host Key Fingerprints Through DNSSEC

Wed, 23 Sep 2026 00:00:00 +0000

SSHFP Publishes SSH Host Key Fingerprints Through DNSSEC

SSH clients need a trustworthy basis for deciding whether a server’s host key belongs to the intended host. A local known_hosts entry supplies that basis after a key has been accepted, but the first connection still needs a verification path if the key was not provisioned in advance.

SSHFP moves a host-key fingerprint into DNS. RFC 4255 defines the SSHFP resource record so a client can compare the public key presented by an SSH server with a fingerprint published for that hostname. The security property depends on authenticated DNS data: a matching fingerprint from an unauthenticated DNS answer does not provide the trust condition defined for secure SSHFP verification.

Host Authentication on Nalar

OpenSSH Host Certificates Replace Per-Host Key Pinning

OpenSSH Host Certificates Replace Per-Host Key Pinning

SSHFP Publishes SSH Host Key Fingerprints Through DNSSEC

SSHFP Publishes SSH Host Key Fingerprints Through DNSSEC