What running your own SSH certificate authority actually costs

Running your own SSH certificate authority (CA) incurs both upfront and ongoing costs. The initial build process, which includes generating key pairs, configuring targets, and signing user keys, typically takes about a week. However, securing the CA key is where the costs really start to accumulate. Storing the CA key in an HSM or KMS requires additional time for integration and the creation of a runbook for handling dependency issues, adding two to four weeks of operational work.

Issuing certificates involves integrating with your identity provider, mapping groups to principals, and building request and approval processes. This can take several months due to the need for requirements clarification and organizational change management. Deploying the CA across the entire infrastructure is a relatively straightforward task, involving changes to sshd_config on each host, but the organizational challenges, such as change windows and rollback plans, can be significant.

For auditing purposes, certificates alone do not provide detailed session information. Additional systems, such as per-command history tracking and session replay, are often required, making the overall solution more complex.

Beyond the initial build, maintaining a production-grade SSH CA system involves ongoing expenses. Regular OpenSSH releases, key rotations, principal changes, on-call rotations, and knowledge concentration risks, especially when the sole knowledgeable person departs, all contribute to the maintenance burden. Accounting for ongoing maintenance and updates, such as those related to Kubernetes and databases, can extend the cost to approximately two to three engineer-quarters, or around $75,000–$150,000 for the build phase and $15,000–$50,000 annually for upkeep.

At a loaded cost of $150–200k per engineer-year, these figures provide a clear picture of the financial commitment involved in running an SSH CA system.