Skip to content

SSH Server Authentication with Certificates

Create a CA

Do it NOT no server!!

ssh-keygen -t ed25519 -f ./ca -C "SSH Certificate Authority"

Configure the SSH Server to Trust the CA

Copy the CA to the server: 

scp ./ca.pub user@server:/etc/ssh/ca.pub

Add the required line to /etc/ssh/sshd_config and restart sshd service: 

echo "TrustedUserCAKeys /etc/ssh/ca.pub" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

Generate a User Key Pair

ssh-keygen -t ed25519 -f ./id_user -C ""

Sign the User's Public Key with the CA

This creates ./id_user-cert.pub.

ssh-keygen -s ./ca \
  -I "user@hostname" \
  -n "username_on_server" \
  -V +52w \
  -z 1 \
  ./id_user.pub

 -I : certificate identity (label)
 -n : Principals — comma-separated list of allowed usernames
 -V : Validity period (`+52w` = 1 year)
 -z : Serial number

Connect to server

ssh -i ./id_user username_on_server@server

Additional actions

Verify the Certificate

ssh-keygen -L -f ./id_user-cert.pub

Revoking a Certificate

ssh-keygen -k -f /etc/ssh/revoked_keys -z 1 ./id_user-cert.pub

Add to /etc/ssh/sshd_config:

echo "RevokedKeys /etc/ssh/revoked_keys" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd