SSH User Certificates Bind CA Trust to Principals
SSH User Certificates Bind CA Trust to Principals Managing SSH access with individual public keys is straightforward at small scale. Each server can keep a list of accepted keys in authorized_keys. As the number of people and hosts grows, however, access control also becomes a key-distribution problem: adding, rotating, and removing identities requires changes across the machines that trust them. OpenSSH user certificates provide a different trust model. A server can trust a user certification authority (CA), then accept user certificates signed by that CA when the certificate also satisfies the server’s authentication policy. The CA signature answers only part of the decision. Principals, validity intervals, certificate options, and server configuration determine where and how the signed key may be used.