The End of Static SSH Keys: Certificate-Based Authentication

Zero-trust SSH access architecture replaces vulnerable, static `authorized_keys` files with short-lived cryptographic SSH certificates. While Smallstep CA provides a lightweight, standards-compliant open-source Certificate Authority for automated certificate rotation, Teleport delivers an enterprise-grade access platform featuring identity-aware proxying, live keystroke session recording, and multi-factor touch requirements for privileged commands.

For over twenty-five years, managing remote server access followed the same pattern: an engineer generated an RSA or Ed25519 keypair, copied the public key to a remote host, and pasted it into `~/.ssh/authorized_keys`. Over time, servers accumulate dozens of forgotten keys from former employees, contractors, and automated scripts—creating an unmanageable web of persistent access.

If an engineer’s unencrypted private key is extracted from a compromised developer laptop, or if a threat actor accesses a backup archive, they gain permanent, undetectable access. Furthermore, standard OpenSSH logs record only that a session opened and closed; they provide zero forensic visibility into what commands were executed.

As we analyzed in our evaluations of self-hosted zero-trust remote access and WireGuard mesh networks (Tailscale vs. NetBird), network-layer encryption must be coupled with identity-aware access planes.

In 2026, modern infrastructure security mandates certificate-based SSH access, spearheaded by **Teleport**, **Smallstep CA**, and **HashiCorp Boundary**.

How SSH Certificate Authorities Work in OpenSSH

SSH certificate authentication relies on native capabilities built directly into the OpenSSH daemon since version 5.4. It requires zero custom agent software on your target Linux hosts:

1. The Host CA Trust: On every server in your infrastructure, you add a single line to `/etc/ssh/sshd_config`:

   TrustedUserCAKeys /etc/ssh/trusted-user-ca.pub

2. The Certificate Issuance: When an engineer begins their workday, they run `step ssh login` or `tsh login`. They authenticate via browser against their identity provider (Authentik, Keycloak, Okta) using a hardware security key (FIDO2 WebAuthn).
3. Ephemeral Key Signing: The Certificate Authority issues an ephemeral SSH certificate (`id_ed25519-cert.pub`) signed by the CA’s private key. The certificate embeds the user’s username, authorized roles (`root`, `admin`, `webadmin`), and an unalterable expiration timestamp:

   Valid: from 2026-10-03T08:00:00 to 2026-10-03T20:00:00

4. Verification at Connection: When the engineer connects via standard `ssh user@server`, the target server verifies the signature against `/etc/ssh/trusted-user-ca.pub` and checks the expiration timestamp. If valid, access is granted instantly.

When the 12-hour window expires, the certificate becomes cryptographically dead. If a laptop is stolen that evening, the attacker holds an expired, useless certificate.

Session Forensics: Keystroke Recording and Moderated Sessions

Where Teleport pulls decisively ahead of standard CA implementations is its **Auditing and Session Recording Plane**.

In standard OpenSSH setups, if a rogue administrator or compromised account runs `rm -rf /var/lib/data` or modifies firewall rules, uncovering the exact sequence of commands requires tedious analysis of shell history files (which the attacker can easily erase with `unset HISTFILE`).

Teleport acts as an identity-aware proxy that captures the full raw terminal pseudoterminal (PTY) stream. Security administrators can open the Teleport web interface and replay the session like a video: seeing every keystroke, typo, output buffer, and executed command in real time. Furthermore, Teleport supports **Moderated Sessions** (dual-party authorization): junior engineers can be prevented from accessing production databases unless a senior architect joins the live session to observe and approve privileged commands.

People Also Ask

Can I use standard SSH clients with Teleport?
Yes, once you authenticate using `tsh login`, Teleport automatically configures your standard OpenSSH configuration file (`~/.ssh/config`). You can continue using native `ssh`, `scp`, `rsync`, and VS Code Remote SSH extensions seamlessly.

What happens if the SSH Certificate Authority server goes down?
Because OpenSSH validates certificates locally using the CA’s public key, existing active certificates continue working until their expiration timestamp. If the CA server goes offline, users cannot issue *new* certificates, but currently authenticated sessions and valid daily leases are completely unaffected.

Is Smallstep CA difficult to self-host?
No, Smallstep CA (`step-ca`) is an open-source Go binary that can be deployed via Docker in under 10 minutes. It includes an embedded BadgerDB key-value store and native CLI tools for automated certificate enrollment.