Using SSH Certificates for Easier and More Secure Access to Your Linux Servers

 Posted on May 10, 2026  |  3 minutes  |  532 words  |  Robert Nilsson

Introduction to SSH Certificates

I’ve seen many Linux admins struggle with managing public keys for SSH access - it’s a real pain. That’s where SSH certificates come in. They offer a more secure and convenient way to access your servers compared to traditional password-based authentication or even public key authentication. By using SSH certificates, you can eliminate the need to manage and distribute public keys, simplify user access management, and enhance security.

How SSH Certificates Work

SSH certificates are based on the concept of public key infrastructure (PKI). A certificate authority (CA) issues certificates to users, which are then used to authenticate to servers. The process involves generating a certificate signing request (CSR) on the client-side, signing it with the CA’s private key, and then using the resulting certificate to authenticate to the server. Don’t bother with the details of PKI if you’re not familiar - just know that it’s a standard way of managing public keys.

To set up SSH certificates, you’ll need to:

  • Generate a CA key pair on your certification authority server
  • Create a certificate signing request (CSR) on the client
  • Sign the CSR with the CA’s private key to generate a certificate
  • Configure your SSH server to trust the CA’s public key

Here’s an example of how to generate a CA key pair and sign a CSR:

# Generate CA key pair
ssh-keygen -t rsa -b 4096 -f ca_key

# Create a certificate signing request (CSR) on the client
ssh-keygen -t rsa -b 4096 -f client_key
ssh-keygen -s ca_key -I client_identity -n client_username -V +52w client_key.pub

# Configure your SSH server to trust the CA's public key
cat ca_key.pub >> /etc/ssh/trusted_user_ca_keys

The real trick is to make sure your CA key is secure - I’ve seen this go wrong when the CA key is not properly protected.

Benefits of SSH Certificates

The benefits of using SSH certificates are numerous:

  • Simplified user management: No need to manage and distribute public keys - this is a huge win for larger organizations.
  • Enhanced security: Certificates can be revoked, reducing the risk of compromised keys.
  • Convenience: Users can access multiple servers with a single certificate - this is especially useful for admins who need to access many servers.

Security Considerations

When implementing SSH certificates, consider the following security best practices:

  • Use a secure CA key: Protect your CA’s private key with a strong passphrase and store it securely - this is crucial.
  • Use a sufficient key size: Use a key size of at least 4096 bits for your CA and client keys - anything less is not secure.
  • Set a reasonable certificate validity period: Set a validity period that balances convenience and security - you don’t want certificates expiring too quickly, but you also don’t want them to be valid for too long.

For more information on SSH certificates, you can refer to the OpenSSH documentation or the Debian wiki.

Troubleshooting

Common issues when setting up SSH certificates include:

  • Certificate not trusted: Verify that the CA’s public key is correctly configured on the server - this is where people usually get burned.
  • Certificate expired: Check the certificate’s validity period and renew it if necessary - it’s easy to forget about certificate expiration.
linux  ssh  security 

See also