Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAn OpenSSH certificate authority (CA) lets you trust one CA public key instead of distributing every individual user and host key. Create separate CA key pairs for users and hosts, sign ordinary OpenSSH public keys with tightly scoped principals and validity periods, then configure servers and clients to trust the appropriate CA. The result is centralized issuance and rotation without changing the underlying private keys used by SSH.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What an OpenSSH CA actually does
An OpenSSH certificate is a signed wrapper around an ordinary public key. It carries the public key, a certificate type, an identity string, validity times, zero or more principals, signed options and extensions, and the CA signature. A relying party verifies the signature with the CA public key and then applies its local policy.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThere are two separate trust directions:
- User certificates: a client presents a certificate proving that its public key was approved by a user CA. The server decides whether the certificate principal is allowed to log in.
- Host certificates: a server presents a certificate proving that its host public key was approved by a host CA. The client checks that the certificate principal matches the name or address it used to connect.
OpenSSH certificates are not X.509 certificates. They use OpenSSH’s own format and are verified by OpenSSH clients and servers. Their main operational benefit is trust compression: a server can trust one user-CA key, and a client can trust one host-CA key, rather than maintaining a separate trust entry for every person or machine.
Plan the CA and trust model first
Use distinct user and host CAs
Create one CA key pair for signing user certificates and another for signing host certificates. Keeping the roles separate limits the damage from a compromise and makes policy easier to reason about. A host CA should never be needed to issue a user login certificate, and vice versa.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
OpenSSH does not provide a certification chain in which a root CA delegates to subordinate CAs. Each relying party therefore needs the public key of the CA that signs the certificates it accepts.
Protect the CA private keys
The CA private keys are the most sensitive assets in this design. Store them away from ordinary SSH servers whenever practical, encrypt them with unique, robust passphrases, restrict filesystem access, and keep an issuance record. Distribute only the CA public keys to clients and servers.
You can keep a signing key in a PKCS#11 token and invoke it with ssh-keygen -D, or use an ssh-agent signing workflow with ssh-keygen -U. Those integrations are optional; a protected local CA key is sufficient for a small deployment.
Choose a local issuance policy
The OpenSSH tools do not impose a universal certificate lifetime, algorithm, revocation schedule or automation system. Document those choices for your environment. Short validity periods reduce the useful lifetime of a stolen certificate, but they require a dependable reissuance process. Record who approved each certificate, which asset or account it covers, and when it should be replaced.
Generate the two CA key pairs
Run CA creation on a protected administration system. The following example uses Ed25519; choose an algorithm supported by the OpenSSH versions in your estate and allowed by your policy.
umask 077
ssh-keygen -t ed25519 -f ca_user -C 'OpenSSH user CA'
ssh-keygen -t ed25519 -f ca_host -C 'OpenSSH host CA'Each command creates an encrypted private key such as ca_user and ca_host, plus a public key with a .pub suffix. Keep the private files in a restricted location. The comment is descriptive metadata; it does not grant trust.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Before distributing a CA public key, obtain and verify its fingerprint through an authenticated channel. A copied public key is useful for verification only when you know it belongs to your organization.
Issue a user (client) certificate
Sign the user’s existing public key
Start with the public key corresponding to the private key the client will use, for example id_ed25519.pub. Sign it with the user CA:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh-keygen -s ./ca_user
-I alice-laptop-2026-10
-V +52w
-n alice
./id_ed25519.pubThe options have specific meanings:
-s ./ca_userselects the CA private key that signs the certificate.-I alice-laptop-2026-10sets the certificate key identifier. OpenSSH records this identifier when the certificate is used, so make it unique and tie it to an issuance or asset record.-V +52wsets the validity interval. This example asks for 52 weeks from the signing time; it is an example policy, not a universal recommendation.-n alicerestricts the certificate principal toalice../id_ed25519.pubis the ordinary public key being wrapped.
The command writes id_ed25519-cert.pub. The private key remains id_ed25519; the certificate is a separate public file.
Use narrow principals. If a certificate is intended only for the Unix account alice, do not issue a broad principal list. A certificate principal is an identity claim that the server must map to an accepted account or policy entry; it is not automatically a local username on every server.
Make the SSH client offer the certificate
Tell the client to offer the original private key together with its certificate. Add a host-specific entry to ~/.ssh/config:
Host bastion.example.com
IdentityFile ~/.ssh/id_ed25519
CertificateFile ~/.ssh/id_ed25519-cert.pubIdentityFile points to the private key used for the cryptographic proof. CertificateFile points to the signed public certificate. The certificate does not replace the private key.
Configure servers to trust user certificates
Install the user CA public key
Copy only ca_user.pub to each destination server through your controlled configuration channel. For example, store it as:
/etc/ssh/ca_user.pubMake the file owned by root and readable only as required by the SSH daemon and system administrators. Do not copy ca_user, the CA private key, to the server.
Recommended Free Tools
Set TrustedUserCAKeys
In /etc/ssh/sshd_config, add:
TrustedUserCAKeys /etc/ssh/ca_user.pubThis makes certificates signed by that CA eligible for user authentication. It does not by itself authorize every principal or every local account.
Choose principal mapping
With no principals file, the login username must appear in the certificate’s principal list. A certificate issued with -n alice can therefore authenticate as the alice account, subject to the rest of the server’s authentication policy.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For explicit policy, add an AuthorizedPrincipalsFile directive:
TrustedUserCAKeys /etc/ssh/ca_user.pub
AuthorizedPrincipalsFile /etc/ssh/auth_principals/%uCreate one principals file per account under /etc/ssh/auth_principals. Put one accepted principal on each line. For example, the file for the local alice account could contain:
Free tools Windows power users keep installed
One-click scans. No signup required.
alice
production-operatorsThis arrangement lets a certificate principal such as production-operators map to selected accounts without issuing a certificate containing every Unix username. Protect the directory and files so an unprivileged user cannot alter the authorization policy.
Validate and reload sshd
- Check the complete daemon configuration:
sshd -t. Fix every reported error before reloading. - Keep an existing administrative session open while testing, so a configuration mistake does not remove your only access path.
- Reload the SSH service using the service manager used by the operating system.
- From a test client, connect with verbose logging, for example
ssh -vvv bastion.example.com, and confirm that the certificate is offered and accepted.
Issue a host certificate
Sign each server’s host public key
Use the existing host public key and the host CA. This example signs an Ed25519 host key:
ssh-keygen -s ./ca_host
-I web-01-2026-10
-V +52w
-h
-n web-01.example.com,10.0.2.15
/etc/ssh/ssh_host_ed25519_key.pubHere, -h marks the certificate as a host certificate. The -n list contains every DNS name and address that clients are expected to use. The command produces:
/etc/ssh/ssh_host_ed25519_key-cert.pubDo not omit an alias, short name or address that appears in connection instructions. A client validates the name it used against the certificate principals; a certificate containing only web-01.example.com will not satisfy a connection made to 10.0.2.15 unless that address is also a principal.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Configure sshd to load the certificate
OpenSSH does not load host certificates automatically. Configure the matching private host key and certificate explicitly:
HostKey /etc/ssh/ssh_host_ed25519_key
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pubHostCertificate must point to a certificate whose public key matches a private key configured with HostKey. A mismatch prevents the daemon from using the certificate.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Install the certificate with ownership and permissions appropriate for the host-key directory, run sshd -t, and reload the daemon. Leave the private host key in place; the certificate adds an authenticated identity for it.
Make clients trust the host CA
Add an @cert-authority known_hosts entry
Distribute ca_host.pub to clients through a controlled configuration-management channel, after verifying its fingerprint. Add an authority entry to each user’s ~/.ssh/known_hosts or to the system-wide ssh_known_hosts file:
@cert-authority *.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... host-caThe marker tells the SSH client that the listed CA may sign host certificates for the matching host pattern. The pattern should cover only names under your control. A wildcard such as *.example.com does not cover the bare name example.com; add a separate pattern if that name is genuinely used.
When a client connects, the server’s host certificate must contain a principal matching the hostname or address in the connection command. Ensure that users connect with one of the names included when the certificate was signed.
Understand what this does not do
An @cert-authority entry does not authenticate an arbitrary host key. It authorizes certificates signed by the specified CA, subject to principal matching and certificate validity. A host that presents an ordinary, unsigned key still needs a normal known-hosts key entry or another configured trust mechanism.
Inspect certificates before deployment
Use ssh-keygen -L to display a certificate’s fields:
ssh-keygen -L -f id_ed25519-cert.pub
ssh-keygen -L -f /etc/ssh/ssh_host_ed25519_key-cert.pubCheck every item below before distributing a certificate:
- The signing CA fingerprint is the expected fingerprint.
- The certificate key type and public key correspond to the intended private key.
- Principals contain only the required account names, service names, DNS names and addresses.
- The validity start and end times match the issuance record and the clocks on relying systems.
- The user principal maps to the intended account or to an accepted line in
AuthorizedPrincipalsFile. - The host certificate includes every name or address clients will use.
- The certificate identifier identifies the person, asset or ticket that authorized issuance.
- Server configuration passes
sshd -t. - A verbose test connection succeeds before broad rollout.
Certificate constraints and operational controls
Keep principals and validity narrow
Do not rely on the default of unrestricted users or hosts. Supply -n deliberately, and use a validity interval that matches the account or asset’s operational need. A shorter interval can limit exposure after theft, while an interval that is too short can cause outages when reissuance is unavailable.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Review options and extensions
OpenSSH certificates can carry signed options and extensions. Review what your signing process permits and avoid granting capabilities that the role does not need. Treat the signing command or automation policy as security-sensitive code: a mistake there can issue certificates with broader access than intended.
Use identifiers for audit trails
The value supplied with -I is the certificate key identifier and is logged when the certificate is used. Include an issuance date, asset name, account or ticket reference in a consistent format. An identifier is an audit aid, not a replacement for server-side authentication and access logs.
Rotation, expiration and incident response
Routine rotation
To rotate a user or host certificate, issue a new certificate from the approved CA with the new validity interval and replace the old certificate on the client or server. The underlying private key can remain unchanged, although your local policy may require key replacement as well.
For CA-key rotation, generate a replacement CA key pair, distribute the new public key to relying parties, issue replacement certificates, and remove the old trust anchor only after the migration window ends. Because OpenSSH has no delegated CA chain, both old and new CA public keys may need to be trusted temporarily during a controlled transition.
Respond to a compromised CA
If a CA private key may have been exposed, stop issuing from it, identify all certificates it signed, and remove or replace that CA public key in every server or client trust configuration. Reissue affected user and host certificates from a new CA, then verify that no relying party still trusts the compromised key. The exact sequence and emergency access path should be documented before an incident occurs.
Handle an expired certificate
An expired certificate cannot authenticate even if the underlying private key is valid. Inspect the certificate with ssh-keygen -L, check system clocks, and issue a replacement with a validity interval that begins at an appropriate time. If a host certificate expires, clients may report a host-authentication failure even though the server is reachable; restore the certificate and reload sshd.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
OpenSSH CA versus per-key trust files
| Decision area | OpenSSH CA | Individual authorized_keys and known_hosts entries |
|---|---|---|
| Trust entries | One CA public key can cover many approved users or hosts, subject to principals and patterns. | Each user public key or host key normally requires its own entry. |
| Issuance and rotation | Issue signed certificates with defined identifiers and validity periods; replace certificates without changing every trust entry. | Add, remove or replace individual keys on each relying system. |
| Principal policy | Principals and optional authorized-principal files provide an explicit identity-to-account policy. | The key entry itself is usually the authorization record, with any forced-command or option restrictions attached there. |
| Auditability | The -I certificate identifier is available when the certificate is used, alongside normal SSH logs. |
Logs identify the key or account, but there is no certificate issuance identifier unless you create one in your own process. |
| Compromise impact | Compromise of a CA private key can affect every certificate that CA could issue, so protection and rapid replacement are critical. | Compromise of one private key generally affects the accounts or hosts that trust that key, though administrative distribution errors can broaden exposure. |
| Compatibility | Requires OpenSSH versions and configurations that support certificates, CA directives and certificate files. | Works with the basic public-key authentication and host-key mechanisms found in older SSH deployments. |
A CA is most useful when many hosts or users must be rotated regularly and you can operate a disciplined signing and key-protection process. Per-key files may be simpler for a small, static environment. The choice is operational: centralizing trust reduces distribution work but increases the importance of CA private-key security and issuance controls.
Troubleshoot the common failures
The client does not offer the certificate
- Confirm that
CertificateFilepoints to the-cert.pubfile and thatIdentityFilepoints to the matching private key. - Run
ssh -vvvand look for the identity and certificate being offered. - Check file permissions and spelling in the host-specific SSH configuration.
The server rejects a user certificate
- Verify that
TrustedUserCAKeysnames the correct user CA public key. - Inspect the certificate’s CA fingerprint, validity interval and principals with
ssh-keygen -L. - Check whether
AuthorizedPrincipalsFileis configured and whether the certificate principal appears on the correct account’s file. - Confirm that the requested login name matches the principal policy.
- Review server logs and ensure the daemon was reloaded after configuration changes.
The client rejects a host certificate
- Confirm that the client’s known-hosts file contains an
@cert-authorityentry for the host pattern. - Verify that the server is loading
HostCertificateand that it matches the private key named byHostKey. - Check that the hostname or address used in the connection appears as a host principal.
- Verify the host CA fingerprint and the certificate validity times.
- Ensure the client is not connecting through an alias omitted from the certificate.
The daemon fails after adding HostCertificate
Run sshd -t before reloading. The usual causes are a nonexistent certificate path, a certificate that does not match any configured private host key, incorrect permissions, or a syntax error elsewhere in sshd_config. Keep an existing session open while correcting the problem.
Quick Recap
A practical rollout sequence
- Define separate user-CA and host-CA owners, storage locations, passphrase controls, issuance approvals and emergency contacts.
- Generate the two CA key pairs on a protected system and record their verified public-key fingerprints.
- Install the user CA public key on one test server and configure
TrustedUserCAKeys. - Issue a short-lived test user certificate with one principal, configure the client, and verify login with verbose output.
- Sign one test server host key, configure
HostCertificate, and verifysshd -t. - Install the host CA public key in a test client’s
known_hostsusing@cert-authority. - Connect using every DNS name and address that production clients will use.
- Inspect certificates, logs and authorization mappings, then expand distribution gradually.
- Document renewal and CA-compromise procedures before relying on certificates for all administrative access.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
