{
  "id": 4804284,
  "title": "What running your own SSH certificate authority actually costs",
  "url": "https://urgent.news/2026/09/01/what-running-your-own-ssh-certificate-authority-actually-costs",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T06:46:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/alektoreef/what-running-your-own-ssh-certificate-authority-actually-costs-44ho"
  },
  "original_language": "en",
  "account": "Running your own SSH certificate authority (CA) incurs both upfront and ongoing costs. The initial build process, which includes generating key pairs, configuring targets, and signing user keys, typically takes about a week. However, securing the CA key is where the costs really start to accumulate. Storing the CA key in an HSM or KMS requires additional time for integration and the creation of a runbook for handling dependency issues, adding two to four weeks of operational work.\n\nIssuing certificates involves integrating with your identity provider, mapping groups to principals, and building request and approval processes. This can take several months due to the need for requirements clarification and organizational change management. Deploying the CA across the entire infrastructure is a relatively straightforward task, involving changes to sshd_config on each host, but the organizational challenges, such as change windows and rollback plans, can be significant.\n\nFor auditing purposes, certificates alone do not provide detailed session information. Additional systems, such as per-command history tracking and session replay, are often required, making the overall solution more complex.\n\nBeyond the initial build, maintaining a production-grade SSH CA system involves ongoing expenses. Regular OpenSSH releases, key rotations, principal changes, on-call rotations, and knowledge concentration risks, especially when the sole knowledgeable person departs, all contribute to the maintenance burden. Accounting for ongoing maintenance and updates, such as those related to Kubernetes and databases, can extend the cost to approximately two to three engineer-quarters, or around $75,000–$150,000 for the build phase and $15,000–$50,000 annually for upkeep. At a loaded cost of $150–200k per engineer-year, these figures provide a clear picture of the financial commitment involved in running an SSH CA system.",
  "summary": "Disclosure: I work on Tessera, which is on the buy side of this. I have tried to cost the build side properly, because a comparison where the build option looks stupid is a comparison nobody believes. Every engineering team that has this problem considers building it. That instinct is correct. SSH certificates are a well-understood, well-documented mechanism, everything you need ships with…",
  "key_points": [
    "Initial build takes about a week, including key generation and configuration.",
    "Securing CA key adds 2-4 weeks of operational work due to HSM/KMS integration.",
    "Ongoing maintenance costs around $15k–$50k annually, totaling $75k–$150k for build and upkeep."
  ],
  "editors_take": "Running an in-house SSH certificate authority means committing significant engineering resources, with estimated costs of $75,000–$150,000 for setup and $15,000–$50,000 per year for maintenance.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}