Ditch the static SSH keys before they become your biggest liability

Technical Briefing | 8/1/2026

Everyone starts with an authorized_keys file and a prayer. It works until a developer leaves with a laptop containing valid credentials or you rotate a dozen servers manually. You shouldn’t be managing keys at scale anymore because it’s a race against the inevitable leak that you won’t detect until it’s already causing damage.

Why CA-signed certificates are the only way out

The transition to short-lived SSH certificates is the single biggest win for operational sanity I’ve seen in years. Instead of distributing public keys, you issue a CA that your servers trust. When a user needs access, they authenticate via OIDC or your existing IDP and get a cert valid for an hour. If the machine gets compromised, the access window is gone before the incident response team even gets their coffee.

ssh-keygen -s ca_key -I admin_user -V +1h -n root,ubuntu id_rsa.pub

• Stop grepping through thousands of files just to see who has access
• Force developers to re-auth against your IDP daily instead of relying on persistent keys
• Use the Principals field to enforce fine-grained access without touching local user accounts
• Revoke access by simply removing the CA from the host if everything goes sideways

You will need to update your sshd_config on the targets to point to the CA public key. It’s a one-time change. Once the trust is established, stop worrying about key rotation schedules that nobody actually follows. If you really want to embrace zero trust, stop building static walls and start issuing temporary passes that vanish on their own.