SSH certificate
also: OpenSSH certificate, SSH user certificate, SSH host certificate
A cryptographic credential issued by a Certificate Authority that verifies the identity of an SSH server or user, enabling secure authentication without relying solely on password exchange or manual key fingerprint verification.
SSH certificates are digital documents signed by a trusted Certificate Authority (CA) that authenticate SSH servers or users. Unlike self-signed public keys, they provide a scalable way to manage authentication across many systems by establishing a chain of trust through a central CA.
SSH certificates are commonly used in two scenarios: host certificates verify that you're connecting to the legitimate server (preventing man-in-the-middle attacks), and user certificates
Example: Instead of distributing and trusting individual user public keys across 100 servers, an organization can issue short-lived user certificates signed by their CA. Users authenticate with their certificate, and servers only need to trust the CA's public key to validate any certificate it issued.
SSH certificates reduce operational overhead, enable automatic key rotation, and allow fine-grained access control through certificate extensions and principals.