Hacker News Reader

SSH certificates avoid this issue and are used in real life. We make them with hashicorp vault, it works well and is really convenient.

View on HN

Have to admit I'm not very familiar with SSH certs.

I'm generally just spinning up a fresh Ubuntu instance on EC2, so I have an entirely 'vanilla' SSH set-up. Small scale, so I don't especially mind the ritual of verifying the fingerprint. It's annoying though that it takes a few minutes for the EC2 system-log to be populated with the 'true value' of the fingerprint.

Huh, I had no idea there was even such a thing as SSH certificates!

Presuming you mean X.509 certificates, is this part of the standard spec (e.g. should work with OpenSSH etc)? Do you know if it works with PuTTY?

Here is a guide I've found useful in the subject, https://engineering.fb.com/security/scalable-and-secure-acce....

They are not based on X.509. I recommend taking a look at the CERTIFICATES section of the ssh-keygen man page, because I am unable to find a good reference on the web right now.

Reply on news.ycombinator.com