https://nalar.dev/tags/openssh/ Recent content in OpenSSH on Nalar Hugo en-us Sun, 20 Sep 2026 00:00:00 +0000 https://nalar.dev/ssh-user-certificates-bind-ca-trust-to-principals/ Sun, 20 Sep 2026 00:00:00 +0000 https://nalar.dev/ssh-user-certificates-bind-ca-trust-to-principals/ <h1 id="ssh-user-certificates-bind-ca-trust-to-principals">SSH User Certificates Bind CA Trust to Principals</h1> <p>Managing SSH access with individual public keys is straightforward at small scale. Each server can keep a list of accepted keys in <code>authorized_keys</code>. As the number of people and hosts grows, however, access control also becomes a key-distribution problem: adding, rotating, and removing identities requires changes across the machines that trust them.</p> <p>OpenSSH user certificates provide a different trust model. A server can trust a user certification authority (CA), then accept user certificates signed by that CA when the certificate also satisfies the server&rsquo;s authentication policy. The CA signature answers only part of the decision. Principals, validity intervals, certificate options, and server configuration determine where and how the signed key may be used.</p>