SSH Expert · Lesson 1 · On the house

CA-signed host and user keys

Operate an SSH certificate authority. Lesson 1 is free — on the house.

Lessons · SSH Expert · Lesson 1 of 10 · On the house

Operate an SSH certificate authority.

A host CA signs host keys; clients trust @cert-authority lines for hostnames.

A user CA signs user keys with principals and extensions (force-command, source-address).

Central issuance beats copying bare keys to thousands of boxes.

Protect CA private keys offline/HSM — compromise is catastrophic.

Automate renewal before expiry; monitor clock skew that breaks validity windows.

# ssh-keygen -s user_ca -I keyid -n principal -V +1d user.pub

Match this when you type.

Quiz

Host CA lets clients?

Quiz

User cert principals commonly encode?

Quiz

CA private keys should be?

Quiz

Clock skew hurts?

Check

Match the still for: CA-signed host and user keys.

Open-book: the answers are on this page. Pass every quiz and check (5) to mark the lesson done. This visit: 0/5.