Stop treating your SSH keys like permanent passwords

Technical Briefing | 8/26/2026

You probably have an authorized_keys file on your production servers that hasn’t been audited in three years. It’s a graveyard of keys from former coworkers and contractors who left ages ago. We tell ourselves it’s fine because the private keys are encrypted, but if a laptop goes missing or a dev gets sloppy with their .ssh directory, that access stays open until you manually clean it up. That’s a massive risk vector that gets ignored because fixing it feels like a chore.

Why certificates beat raw keys every time

Static keys are inherently anti-Zero Trust. You don’t get expiration, you don’t get per-user metadata, and you certainly don’t get easy revocation. By switching to SSH certificates, you turn those permanent credentials into ephemeral tokens that expire by default in a few hours. When I moved our infra to use an SSH CA, the panic of offboarding employees disappeared. If a key is compromised, you just wait for the window to close or update your revocation list. Most people stick to keys because setting up a CA sounds hard, but it’s really just signing a public key with a master identity.

ssh-keygen -s ca_key -I host_user_id -V +8h -n username user_key.pub

• Certificate expiration forces users to re-authenticate with your SSO provider regularly
• The -n flag ensures a key is only valid for a specific user rather than letting it impersonate anyone
• Logging becomes much cleaner because you can track exactly which CA signed the key used for a session

Handling the human friction

The biggest pushback you’ll get is that asking people to re-authenticate twice a day is annoying. That’s fair, but that’s exactly what an ssh-agent and a small wrapper script are for. You don’t force users to manually run commands; you integrate the flow into their shell login or their terminal emulator profile. If you make the secure path the easiest path, your team will stop hoarding keys in random folders.

If you are still managing access by appending lines to authorized_keys, you aren’t doing Zero Trust, you’re just doing manual key management at scale. Spend an afternoon setting up a basic CA. Your audit logs and your sleep schedule will thank you.