--- title: SSH Certificates Security Hardening | daily.dev description: SSH certificates improve security over raw public keys but only when deployed correctly, addressing problems like trust-on-first-use (TOFU) fatigue and the... canonical: https://daily.dev/posts/ssh-certificates-security-hardening-ygacwjeip twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SSH Certificates Security Hardening | daily.dev og:description: SSH certificates improve security over raw public keys but only when deployed correctly, addressing problems like trust-on-first-use (TOFU) fatigue and the... og:url: https://daily.dev/posts/ssh-certificates-security-hardening-ygacwjeip og:image: https://api.daily.dev/og/posts/YGaCwJeiP.png og:image:alt: SSH Certificates Security Hardening og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SSH Certificates Security Hardening **[Teleport](https://daily.dev/sources/teleport)** · 8 min read · 0 upvotes · 0 comments ## Summary SSH certificates improve security over raw public keys but only when deployed correctly, addressing problems like trust-on-first-use (TOFU) fatigue and the operational burden of distributing and rotating public keys across many servers and users. Certificates solve TOFU by having hosts present signed certs with hostname metadata and expiration dates, verified against a trusted certificate authority. However, certificates introduce new risks: if a CA private key is compromised, all issued certificates must be revoked and reissued. The recommended mitigation is short-lived certificates (hours, not long-term) combined with SSO-based issuance, and regular rotation of CA keys so that revocation lists become unnecessary and compromise windows stay small. Practical examples use Teleport's CLI tool tsh to issue GitHub-SSO-backed certs and rotate CAs in under a minute. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do SSH certificates solve the trust on first use (TOFU) problem? SSH certificates let a host present a certificate signed by a trusted certificate authority, containing the hostname and an expiration date, instead of a bare public key. Even if a host's IP or public key changes after re-provisioning in a cloud environment, the certificate still validates against the CA, so clients no longer see the scary TOFU warning caused by IP or hostname reuse. _Teams debugging SSH host key warnings can track hardening approaches like this on daily.dev._ ### What is the risk of using long-lived SSH certificates instead of short-lived ones? Long-lived certificates increase the window of exposure if a certificate authority's private key is compromised, since every issued certificate must then be revoked and reissued, and revocation systems are rarely tested so they can silently fail. The recommended practice is issuing certs valid for only a few hours, ideally just the length of a session, so expiration replaces the need for revocation lists. _Engineers designing SSH access policies can follow certificate lifecycle practices like these via daily.dev._ ### How can I rotate an SSH certificate authority without breaking user access? Rotating a user certificate authority invalidates all certificates issued by the old CA, but if single sign-on (SSO) is used for authentication, users simply re-login to obtain new certificates automatically. Teleport's tooling demonstrates rotating a user CA in under a minute, with the same command also rotating host CAs, turning CA rotation into a routine daily practice rather than a rare, risky event. _Anyone planning CA rotation strategy can compare SSH access tooling approaches on daily.dev._ ## Similar posts on daily.dev - [Jan-Piet Mens :: SSH certificates: the better SSH experience](https://daily.dev/posts/jan-piet-mens-ssh-certificates-the-better-ssh-experience-f1ftumowi) · Jan-Piet Mens · 0 upvotes · 0 comments - [SSH certificates and git signing](https://daily.dev/posts/ssh-certificates-and-git-signing-xbor3hzac) · Lobsters · 6 upvotes · 1 comments - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/ssh-certificates-security-hardening-ygacwjeip) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SSH Certificates Security Hardening","url":"https://daily.dev/posts/ssh-certificates-security-hardening-ygacwjeip","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ssh-certificates-security-hardening-ygacwjeip"},"datePublished":"2026-08-23T12:19:28.875Z","dateModified":"2026-08-23T12:35:51.011Z","description":"SSH certificates improve security over raw public keys but only when deployed correctly, addressing problems like trust-on-first-use (TOFU) fatigue and the...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ssh-certificates-security-hardening-ygacwjeip","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,ssh","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SSH Certificates Security Hardening"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ssh-certificates-security-hardening-ygacwjeip#faq","mainEntity":[{"@type":"Question","name":"How do SSH certificates solve the trust on first use (TOFU) problem?","acceptedAnswer":{"@type":"Answer","text":"SSH certificates let a host present a certificate signed by a trusted certificate authority, containing the hostname and an expiration date, instead of a bare public key. Even if a host's IP or public key changes after re-provisioning in a cloud environment, the certificate still validates against the CA, so clients no longer see the scary TOFU warning caused by IP or hostname reuse. Teams debugging SSH host key warnings can track hardening approaches like this on daily.dev."}},{"@type":"Question","name":"What is the risk of using long-lived SSH certificates instead of short-lived ones?","acceptedAnswer":{"@type":"Answer","text":"Long-lived certificates increase the window of exposure if a certificate authority's private key is compromised, since every issued certificate must then be revoked and reissued, and revocation systems are rarely tested so they can silently fail. The recommended practice is issuing certs valid for only a few hours, ideally just the length of a session, so expiration replaces the need for revocation lists. Engineers designing SSH access policies can follow certificate lifecycle practices like these via daily.dev."}},{"@type":"Question","name":"How can I rotate an SSH certificate authority without breaking user access?","acceptedAnswer":{"@type":"Answer","text":"Rotating a user certificate authority invalidates all certificates issued by the old CA, but if single sign-on (SSO) is used for authentication, users simply re-login to obtain new certificates automatically. Teleport's tooling demonstrates rotating a user CA in under a minute, with the same command also rotating host CAs, turning CA rotation into a routine daily practice rather than a rare, risky event. Anyone planning CA rotation strategy can compare SSH access tooling approaches on daily.dev."}}]} ```