Hacker News Reader

Comment by tptacek | Hacker News Reader

I'm a fan of SSH certificates and cannot understand why anyone would set up certificate authentication with an external third-party CA. When I'm selling people on SSH CA's, the first thing I usually have to convince them of is that I'm not saying they should trust some third party. You know where all your servers are. External CAs exist to solve the counterparty introduction problem, which is a problem SSH servers do not have.

View on HN

> I'm a fan of SSH certificates and cannot understand why anyone would set up certificate authentication with an external third-party CA.

I think the sales pitch for these sorts of service is: "Get an SSH-like experience, but it integrates with your corporate single-sign-on system, has activity logs that can't be deleted even if you're root on the target, sorts out your every-ephemeral-cloud-instance-has-a-different-fingerprint issues, and we'll sort out all the reverse-tunnelling-through-NAT and bastion-host-for-virtual-private-cloud stuff too"

Big businesses pursuing SOC2 compliance love this sort of thing.

We've been SOC2 Type 2 for several years and I'd push back on that.

https://fly.io/blog/soc2-the-screenshots-will-continue-until...

I'm with you, I imagine it's mostly people just drawing parallels, they can figure out how to get a web certificate so think SSH is the same thing.

The second order problem I've found is when you dig in there are plenty of people who ask for certs but when push comes to shove really want functionality where when user access is cancelled all active sessions get torn down immediatly as well.

Same reasons for companies still buying “CrowdStrike” and installing that crapware. It’s all for regulatory checkboxes (ie, fedramp cert).

I do not believe you in fact need any kind of SSH CA, let alone one run by a third party, to be FedRAMP-compliant.

Reply on news.ycombinator.com