Keys or Certs for SSH Access? Why should I care?
summary
Compares public/private SSH keys to short-term certificates and shows a working demo that uses ed25519 keys, a CA to sign user and host certs, and a Docker Compose bastion→app setup so certificates authenticate without the usual host key prompt. Certificates carry metadata and expiry windows (demo uses ~5 and 15 minute TTLs) so access is denied when expired. Covers tooling and scaling pain points, mentions Teleport as an open source access plane, and shows the cert workflow actually succeeds end to end.
AI-written summary · about
chapters (9)
- 0:00SSH access methods
- 1:17Why keys became default
- 5:11Public key authentication problems
- 10:26SSH certificates history
- 13:37Advantages of SSH certs
- 16:03How SSH certs work
- 21:39Live demo: SSH certs
- 29:52Getting started with SSH certs
- 31:35Q&A
related talks
41mA better way to SSH: Introducing SSH certificates
11mIf You’re Not Using SSH Certificates You’re Doing SSH Wrong
44mEngineering Secure SSH Access for Engineers
28mManaging SSH Access without Managing SSH Keys- 44mEngineering Secure SSH Access for Engineers
29mSSH Certificates: a way to scale SSH access
23mAutomation with Scalable & Secure SSH
45mZero Trust SSH