Moving to ephemeral SSH certificates is the right move for Zero Trust, but most folks forget that an expired CA key or a missed certificate window will lock out your entire infrastructure in minutes. I have seen a team lose access to an entire production cluster because they treated certificate lifespans like static passwords that last forever. If your automation doesn’t account for the rotation lifecycle, you’re not actually improving security; you’re just building a self-inflicted denial of service.

Why short-lived certs bite you in the rear

When you issue a certificate that only lasts for an hour, your automation needs to be rock solid. If your local system clock drifts or your SSH agent starts acting up, you end up with a valid key that the server rejects as expired. It is invisible, silent, and entirely infuriating to debug when you are staring at an Access Denied error that was working perfectly ten minutes ago.

ssh-keygen -Lf /path/to/user_key-cert.pub | grep 'Valid: after'

• Audit the validity window using ssh-keygen to check the certificate metadata.
• Check your NTP sync status on both the client and the target nodes, because absolute time drift kills cert validation.
• Configure your SSH agent to clear expired keys so you aren’t trying to auth with a bag of dead identities.

Managing the CA trust anchor

The worst part is that most tutorials suggest shoving the CA public key into authorized_keys and calling it a day. That’s a mistake. You should be using TrustedUserCAKeys in your sshd_config. This keeps your key management centralized and out of user-level configuration files where a malicious script or an accidental override can silently remove your gatekeeper.

Stop relying on the hope that your certs are still valid and start piping your key expiry checks into your pre-flight automation. If you can’t verify the expiration locally before you run your deploy, you’re just waiting for the next midnight crisis. Next time you’re setting up a new jump host, set an alert for the CA key rollover date or you will be resetting that server manually when the cert inevitably dies.