SSH PKI manager


Currently issued certificates for CA.pub

{% if not hosts %} {% else %} {% for host in hosts %} {% endfor %} {% endif %} {% if not users %} {% else %} {% for user in users %} {% endfor %} {% endif %}
Hostname(s) Issue Date Description Key Signature
No data
{{ host[1] }} {{ host[4] }} {{ host[3] }}
Username Issue Date Description Key Signature
No data
{{ user[1] }} {{ user[4] }} {{ user[3] }}

Sign Host Key


Sign User Key


Useful configuration items

SSHD Config

Paste the following italic in the sshd config

HostCertificate /etc/ssh/HOSTKEY-cert.pub
TrustedUserCAKeys /etc/ssh/CA.pub

Where HOSTKEY-cert.pub is the signed host certificate and CA.pub is the root CA

SSHD Config

Add the following to the known_hosts file

@cert-authority LIST-OF-SERVERS ssh-ed25519 AAAAB3Nza.....

Where the key is the CA and LIST-OF-SERVERS is a csv of hostnames and wildcards, example: hostname.domain.tld,*.ssh.domain.tld