--- title: How to manage SSH keys? | daily.dev description: Argues that managing SSH keys manually with key managers doesn't scale for infrastructure teams and is prone to security errors. Recommends replacing key-based... canonical: https://daily.dev/posts/how-to-manage-ssh-keys--cqxpueaii twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to manage SSH keys? | daily.dev og:description: Argues that managing SSH keys manually with key managers doesn't scale for infrastructure teams and is prone to security errors. Recommends replacing key-based... og:url: https://daily.dev/posts/how-to-manage-ssh-keys--cqxpueaii og:image: https://api.daily.dev/og/posts/CQXPuEAii.png og:image:alt: How to manage SSH keys? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to manage SSH keys? **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary Argues that managing SSH keys manually with key managers doesn't scale for infrastructure teams and is prone to security errors. Recommends replacing key-based authentication with short-lived, automatically expiring SSH certificates signed by a trusted certificate authority (CA), which eliminates the need to distribute and rotate public keys across servers and users. Covers how SSH certificates work, their properties (expiration, embedded metadata), and notes both OpenSSH and Teleport support certificate-based authentication, with Teleport built specifically around this model. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between SSH key authentication and SSH certificate authentication? SSH key authentication requires every server to maintain a list of trusted public keys for every user, and every user to maintain known_hosts entries for every server, requiring constant manual updates as people and machines change. SSH certificate authentication instead has a trusted certificate authority sign public keys, so users and servers only need to agree on which CA to trust rather than exchanging and storing individual keys. _Teams weighing key-based versus certificate-based SSH access can track this debate on daily.dev._ ### What properties do SSH certificates have that plain SSH keys don't? An SSH certificate is a public key bundled with a digital signature from a certificate authority's private key, meaning only that CA can issue valid certificates. Certificates can carry a validity date range so they automatically expire, and they can embed arbitrary signed metadata, such as disabling port forwarding, giving the CA fine-grained control over how a certificate may be used. _daily.dev helps engineers researching SSH certificate mechanics stay current on infrastructure security practices._ ### Which SSH servers support certificate-based authentication instead of key-based authentication? OpenSSH supports certificate-based authentication and is documented in RedHat's configuration guide, though it needs careful setup since it supports every SSH authentication method by default. Teleport, an open source SSH server adopted by companies including NASDAQ, Qualcomm, and Samsung, is built specifically around certificate-based access and optimizes its defaults for that model. _Engineers comparing OpenSSH and Teleport for certificate-based access can follow both on daily.dev._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Jan-Piet Mens :: SSH certificates: the better SSH experience](https://daily.dev/posts/jan-piet-mens-ssh-certificates-the-better-ssh-experience-f1ftumowi) · Jan-Piet Mens · 0 upvotes · 0 comments - [SSH certificates and git signing](https://daily.dev/posts/ssh-certificates-and-git-signing-xbor3hzac) · Lobsters · 6 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/how-to-manage-ssh-keys--cqxpueaii) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to manage SSH keys?","url":"https://daily.dev/posts/how-to-manage-ssh-keys--cqxpueaii","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-manage-ssh-keys--cqxpueaii"},"datePublished":"2026-08-23T12:23:27.859Z","dateModified":"2026-08-23T12:54:40.481Z","description":"Argues that managing SSH keys manually with key managers doesn't scale for infrastructure teams and is prone to security errors. Recommends replacing key-based...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-manage-ssh-keys--cqxpueaii","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,ssh","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How to manage SSH keys?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-manage-ssh-keys--cqxpueaii#faq","mainEntity":[{"@type":"Question","name":"What is the difference between SSH key authentication and SSH certificate authentication?","acceptedAnswer":{"@type":"Answer","text":"SSH key authentication requires every server to maintain a list of trusted public keys for every user, and every user to maintain known_hosts entries for every server, requiring constant manual updates as people and machines change. SSH certificate authentication instead has a trusted certificate authority sign public keys, so users and servers only need to agree on which CA to trust rather than exchanging and storing individual keys. Teams weighing key-based versus certificate-based SSH access can track this debate on daily.dev."}},{"@type":"Question","name":"What properties do SSH certificates have that plain SSH keys don't?","acceptedAnswer":{"@type":"Answer","text":"An SSH certificate is a public key bundled with a digital signature from a certificate authority's private key, meaning only that CA can issue valid certificates. Certificates can carry a validity date range so they automatically expire, and they can embed arbitrary signed metadata, such as disabling port forwarding, giving the CA fine-grained control over how a certificate may be used. daily.dev helps engineers researching SSH certificate mechanics stay current on infrastructure security practices."}},{"@type":"Question","name":"Which SSH servers support certificate-based authentication instead of key-based authentication?","acceptedAnswer":{"@type":"Answer","text":"OpenSSH supports certificate-based authentication and is documented in RedHat's configuration guide, though it needs careful setup since it supports every SSH authentication method by default. Teleport, an open source SSH server adopted by companies including NASDAQ, Qualcomm, and Samsung, is built specifically around certificate-based access and optimizes its defaults for that model. Engineers comparing OpenSSH and Teleport for certificate-based access can follow both on daily.dev."}}]} ```