Hacker News Reader

Comment by ultra_nick | Hacker News Reader

What's the difference between a certificate and a public/private keys?

Certificate is short lived and signed on the fly for when you need it. The server trusts your SSH CA, and you can ask it to sign any private key you want, with a ttl.

So you get extra security (credentials are dynamic and short -lived, and also per-user if needed) and lower maintenance because you only have the SSH CA public key to setup on all machines and that one needs less rotation/updates than public keys.

But then don't you need to maintain this CA certificate? I guess it makes sense for wider centralized access.

A certificate doesn't necessarily have to be short lived, although in practice they usually are.

The main difference is that with an ssh key, you install the public key directly on the target host. With a certificate, you Just tell the host to trust a CA, and use that CA to sign client certificates.

> lower maintenance because you only have the SSH CA public key to setup on all machines

This is hardly "lower maintenance" than pushing updates to the authorized_keys across servers.

Or having servers poll for such file.

You add the intermediate key to config for trust. You do not need authorized_keys files for each user. Good for team and central management and faster key rotation but then needs trusted intermediate authority which is secure. No password or key rotation on machine itself which is good if you have a lot of machines.

Reply on news.ycombinator.com