Eliminating SSH Static Keys with Ephemeral Certificates and Identity Propagation

Technical Briefing | 7/9/2026

Traditional static SSH keys represent a significant security liability in modern distributed systems, as they are often misplaced, improperly shared, or reside on disk indefinitely. By moving to an ephemeral certificate-based infrastructure, you can enforce strict, time-bound access control that aligns with Zero Trust principles, where every login requires cryptographic verification against a central short-lived signing authority.

Leveraging SSH Certificates for Just-In-Time Access

Instead of distributing public keys, you configure Linux hosts to trust a specific Certificate Authority. Users request a certificate that expires after a few hours, often tied to their organizational SSO identity. This eliminates the need for managing authorized_keys files across fleets and ensures that stolen credentials have a naturally shrinking window of opportunity.

ssh-keygen -s ca_key -I user_identity -V +1h -n root -O permit-pty -O source-address=192.168.1.0/24 user_id_rsa.pub

• Certificate expiry acts as an automated revocation mechanism
• Source IP restrictions embedded directly in the signed identity
• Audit logs capture the unique serial number of every certificate used
• Decouples host access from local account management

By implementing this architecture, you transform your SSH infrastructure from a static, perimeter-based model into a dynamic, identity-aware framework. The use of signed principals and restrictive critical options ensures that even if a server is compromised, the lack of stored persistent credentials prevents lateral movement through standard SSH channels.