SSH Certificate Authentication with ssh-keygen (2026)
You have forty devices in the field, three people who need shell access, and an authorized_keys file on every one of them. Someone leaves, and you get to touch forty files. Someone gets a new laptop, and you get to touch forty files again. A device gets reflashed, and everyone's terminal shouts that the host key changed. SSH certificate authentication fixes both directions of that problem with…
SSH certificate authentication simplifies the process of managing shell access across multiple devices and servers. Instead of copying public keys to each server, you sign the user's key pair with a Certificate Authority (CA) key, resulting in a certificate file (id_ed25519-cert.pub) that contains the user's public key and metadata.
When a user connects with a certificate, the server verifies three things: the CA signature's validity, the certificate's validity window, and one of its principals (account or role names) allowed for the account being logged into. This method eliminates the need for an authorized_keys file and the "are you sure you want to continue connecting?" prompt.
There are two types of certificates: user certificates and host certificates. User certificates are signed by a user CA, while host certificates are signed by a host CA. The server only needs the CA's public key to trust the certificates. Both certificates are in a simplified format, not X.509, and do not require OpenSSL, a PKI team, or a CRL server.
To create SSH certificate authority keys, generate two Ed25519 keys, one for users and one for hosts, using ssh-keygen. Keep the private keys secure and treat them like a root password. A naming plan for principals (roles) is essential, such as fleet-ops, deploy, and readonly. Each server should define which roles can log into which account.
To sign a user certificate with ssh-keygen -s, generate a key pair and send only the .pub file to the CA. Use the -s flag to specify the user CA, -I for the key ID, -n for the principals, -V for the validity window, and -z for a serial number. The resulting certificate (ops_key-cert.pub) can be inspected with ssh-keygen -L.
Restricting a certificate's permissions is possible with -O flags, such as -O clear to remove default permissions and -O permit-pty for a specific use case, like a backup job. The certificate's validity, principals, and other options can be managed effectively using these flags.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.