NanoSSH is an embedded SSH-2 client/server library, not a desktop SSH command or a complete device-management system. It originated with Mocana and is now documented as NanoSSH within DigiCert TrustCore SDK. Firmware teams can use it to add SSH administration, SFTP file transfer, outbound SSH connections, port forwarding, and certificate- or RADIUS-based authentication to constrained devices. The exact algorithms, compliance options, licensing terms, and platform support depend on the TrustCore SDK components and build configuration you select.
The current product documentation is at DigiCert TrustCore SDK NanoSSH. An older Embedded.com listing describes historical Mocana positioning and should not be treated as a current specification.
As an Amazon Associate I earn from qualifying purchases.
What NanoSSH is—and is not
NanoSSH supplies the protocol and security machinery needed to embed SSH functionality in firmware or an appliance. Your product still supplies the device identity, authorization rules, command handlers, storage implementation, update policy, and recovery process.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- It is an embedded SSH client and server implementation.
- It is not a Linux distribution, a replacement for the
sshcommand on a desktop, or a ready-made fleet-management platform. - It does not automatically create a secure device CLI or decide which authenticated user may erase flash, replace firmware, or read secrets.
DigiCert describes NanoSSH as a lightweight, standards-oriented SSH-2 component for embedded devices, network hardware, cloud-native workloads, and other platforms. The API documentation retains the “Mocana NanoSSH” name, which explains why both brands appear in older products and current manuals.
#1 Best Overall
What it can provide
SSH client
An embedded device can initiate an SSH connection to a server for diagnostics upload, configuration or update retrieval, controlled remote commands, or an outbound management channel. The client API is documented at NanoSSH client API reference.
SSH server and device CLI
A device can accept administrative or service connections and expose a shell-like interface. The manufacturer defines the commands, arguments, accounts, certificates, and privilege boundaries; NanoSSH does not require you to expose an unrestricted operating-system shell. Server functionality is described in the NanoSSH server API reference.
SFTP
The server can provide SFTP, but an embedded target may not have a POSIX filesystem. DigiCert’s customization guide requires application-supplied file routines and a virtual filesystem mapping. A virtual path can map to flash, RAM, a secure partition, removable storage, or another backend rather than directly exposing the underlying filesystem. See Customize a NanoSSH server implementation.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPort forwarding
Client-side port forwarding can carry a TCP stream through an SSH tunnel. It is useful for maintenance access to a protected service, but it can also bypass intended network boundaries. Permit only explicitly required destinations and apply the same authorization, logging, and connection limits as other management functions.
Authentication and cryptography
DigiCert lists RADIUS and X.509v3 certificate authentication, while historical Mocana material also promoted those capabilities. Availability can vary by edition, target, and license. DigiCert says ECC, AES-GCM, and SHA-2 are available when NanoSSH is linked with NanoCrypto Advanced or a NanoCrypto FIPS module; the standard TrustCore SDK includes NanoCrypto Basic, which does not include Suite B or FIPS mode. The API documentation likewise qualifies NSA Suite B functions as requiring NanoSSH Advanced unless DigiCert FIPS binaries are used.
That does not mean every NanoSSH build is FIPS validated. Verify the exact cryptographic module, version, approved mode, hardware and firmware boundary, and deployed configuration against the applicable validation certificate.
Platforms, standards, and compatibility
DigiCert lists Intel x86, ARM Cortex-A, ARM Cortex-M, and MIPS32 targets; Intel AES-NI acceleration; vendor acceleration through NanoCrypto callbacks; and TPM 1.2 secure-element integration. The SDK is described as portable to additional POSIX-compatible systems and embedded RTOS environments, but portability still requires integration work for the specific TCP/IP stack, scheduler, toolchain, and storage model.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Documented protocol references include RFC 4250, 4251, 4252, 4253, 4344, 4335, and 4419. RFC 4254 (the SSH connection protocol) is listed as partially supported. SFTP protocol versions 2, 3, and 4 are listed. Do not interpret this as universal compatibility: test the exact OpenSSH, PuTTY, Dropbear, SFTP, certificate-authority, and automation clients used in deployment.
How NanoSSH fits into firmware
SSH client or administrator
|
TCP/IP stack
|
NanoSSH transport, authentication, and channels
|
OEM command dispatcher / SFTP callbacks
|
RTOS, filesystem, secure storage, and device servicesThe library terminates SSH and authenticates peers; the surrounding application decides what an authenticated identity can do. That separation is central to a safe design.
Integration workflow
- Choose client, server, or both. Client-only operation usually reduces inbound attack surface. A server is required for remote maintenance or an SSH-accessible CLI.
- Inventory the target. Record CPU, RTOS or operating system, TCP/IP stack, event-loop or threading model, RAM and flash, entropy source, persistent key storage, and any TPM or secure element.
- Select the SDK and crypto tier. Confirm whether Basic, Advanced, or FIPS-related components provide the algorithms and compliance evidence you need. Do not assume optional features are in the default package.
- Build and run the vendor example first. DigiCert’s server guide recommends proving the example in the intended environment before customization.
- Set version-specific build controls. The guide documents examples such as
__DISABLE_OPEN_SSH_AES_GCM__,__DISABLE_MOCANA_INIT__,__DISABLE_MOCANA_SSH_COMMON_NAME_CHECK__,__DISABLE_MOCANA_SSH_RSA_KEY_EXCHANGE__, and__ENABLE_MOCANA_SSH_FTP_SERVER__. Treat these as release-specific controls, not universal settings. - Bind platform services. Connect network I/O, timers, memory allocation, random-number generation, file I/O, task or thread handling, persistent key storage, logging, and error reporting.
- Define authentication and authorization separately. Authentication establishes identity; authorization limits commands, files, tunnels, and administrative actions.
- Implement the command interface. Use an allowlist of product-specific commands and validate every argument. Avoid shell escape and arbitrary executable launch unless they are an explicit, controlled requirement.
- Implement SFTP callbacks if enabled. Replace stub routines, configure the virtual filesystem, map virtual paths to physical storage, enforce permissions, and design safe handling for interrupted writes.
- Rebuild and test the integrated image. Exercise interoperability, failure handling, resource limits, update and recovery paths, and production hardening on the actual hardware.
Security decisions the device maker still owns
Host keys and secure storage
Generate a unique server host key per device. Store private material in protected flash, a TPM, or a secure element where possible; never ship one private host key in every unit. Define behavior for factory reset, key replacement, provisioning failure, and cloned images.
Authentication policy
Evaluate password, public-key, X.509 certificate, RADIUS, device-certificate, and temporary-service credentials against your threat model. Include brute-force resistance, lockout or throttling, certificate expiry and revocation, clock initialization, rotation, and an offline recovery path.
Authorization and exposure
- Bind SSH only to the intended management interface.
- Separate management and data networks and firewall the service.
- Use connection limits, rate limiting, and idle-session timeouts.
- Log successful and failed authentication and sensitive commands.
- Restrict SFTP to explicit directories and prevent access to credentials or inactive firmware images.
- Disable the service when the product does not need it; avoid direct public-internet exposure.
Compliance wording
“Supports FIPS” and “is FIPS validated” are different statements. Procurement and security teams should obtain the validation certificate and confirm the module version, approved operating mode, algorithm and key-size requirements, physical and logical boundary, and whether the shipping build matches that scope.
Footprint, licensing, and operational trade-offs
No universal RAM or flash number
NanoSSH is marketed as lightweight, but the available documentation does not establish one current, independently verified footprint. Resource use changes with client versus server, SFTP, certificate support, cryptographic module, enabled algorithms, filesystem layer, debug symbols, compiler optimization, architecture, and threading model. Measure the exact production configuration.
Dual licensing
DigiCert’s NanoSSH client guide describes an AGPLv3 option and a commercial license for proprietary or closed-source firmware and commercial SaaS applications. “Free” and “paid” are incomplete answers: determine whether your distribution can meet AGPLv3 obligations or obtain acceptable commercial terms, including redistribution and product-count conditions. No public NanoSSH price is stated in the current product documentation.
Vendor dependency
A commercial SDK can reduce protocol and cryptography maintenance while creating dependency on vendor support, roadmap, release cadence, supported toolchains, license agreements, and migration assistance if the component is discontinued.
Rank #4
- Used Book in Good Condition
Failure modes to test before release
| Symptom | Likely areas to inspect |
|---|---|
| Handshake or connection failure | Key-exchange or cipher mismatch, host-key validation, entropy, TCP callbacks, firewall rules, timeouts, or concurrent-session limits. |
| Certificate authentication rejected | Untrusted chain, identity or common-name mismatch, expired certificate, incorrect boot clock, wrong key format, unavailable RADIUS, or a missing Advanced/FIPS component. |
| User authenticates but cannot perform an action | Authorization policy, command allowlist, account role, SFTP permissions, or a deliberately restricted shell. |
| SFTP cannot read or write | Unmapped virtual path, unreplaced stub routine, flash failure, insufficient space, permissions, interrupted transfer, or unsafe non-atomic update logic. |
| Device becomes unresponsive | Many handshakes, repeated failed logins, slow or abandoned clients, fragmented packets, large transfers, low memory, or power loss during storage writes. |
The documented __DISABLE_MOCANA_SSH_COMMON_NAME_CHECK__ option can weaken certificate identity checking. It is not a routine troubleshooting switch; use it only with a documented, narrowly controlled design and compensating identity checks.
Recovery planning
Specify what happens after lost administrator credentials, expired certificates, invalid SSH configuration, a broken firmware update, management-interface failure, or a malicious client that consumes resources. Recovery should use a controlled service procedure or authenticated local mechanism, not an undocumented universal backdoor.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.NanoSSH compared with common alternatives
| Option | Best fit | Questions to resolve |
|---|---|---|
| NanoSSH (DigiCert TrustCore SDK) | OEM firmware and RTOS or constrained targets needing vendor-backed embedded integration, SSH/SFTP, certificates, RADIUS, or specialized crypto options. | Commercial terms, exact SDK edition, target support, footprint, validation scope, and vendor lifecycle. |
| Dropbear | Embedded Linux with a conventional Unix-style userland and an open-source maintenance model. | License obligations, required features, SFTP arrangement, patch ownership, and measured footprint. |
| OpenSSH | Embedded Linux systems with sufficient storage, memory, process isolation, and a need for broad ecosystem compatibility. | Whether its service model and resource use are excessive for the device. |
| wolfSSH | Teams already standardized on the wolfSSL ecosystem and seeking a related embedded vendor. | Platform, licensing, feature, and support fit for the actual product. |
| libssh or libssh2 | Client-focused integrations with a suitable C runtime and networking environment. | Licensing, server requirements, authentication features, and integration effort. |
| Purpose-built mutually authenticated protocol | A narrowly defined machine-to-machine operation that does not need general SSH administration. | Whether reduced scope truly outweighs losing SSH interoperability; it is not a drop-in SSH replacement. |
Questions to put in a NanoSSH evaluation
- Which NanoSSH and TrustCore SDK release is currently supported?
- Which RTOSes, operating systems, CPUs, compilers, and network stacks are covered?
- What are the measured RAM, flash, stack, and persistent-storage requirements for the intended build?
- Which key-exchange, host-key, cipher, MAC, and authentication algorithms are enabled?
- Which capabilities require Advanced or FIPS components?
- Is SFTP included, and how much filesystem callback and virtual-path work is required?
- What is the vulnerability-response and patch policy?
- Are source, object, or binary-only deliverables supplied?
- What are the AGPLv3, commercial, redistribution, and product-count terms?
- Can an evaluation package run on the actual target hardware?
- Are the intended secure element or TPM parts supported?
- How will legacy algorithms be disabled without stranding deployed devices?
Frequently Asked Questions
Is NanoSSH open source?
DigiCert documents a dual-license model: AGPLv3 use under its license terms or a commercial license for proprietary and closed-source products. Review the current agreement for your distribution model.
Is NanoSSH the same as OpenSSH?
No. NanoSSH is an embeddable client/server library from the Mocana product lineage, now documented in DigiCert TrustCore SDK. OpenSSH is a separate, full-featured implementation commonly deployed on Unix-like systems.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Can NanoSSH run on an RTOS?
DigiCert describes portability to embedded RTOS environments and lists ARM Cortex-M and other targets, but the specific RTOS, TCP/IP stack, toolchain, callbacks, and storage integration must be confirmed for your build.
Does it include an SFTP server?
Server-side SFTP is available in the SDK, but embedded products generally must supply filesystem routines and map NanoSSH’s virtual paths to real storage.
Can it use certificates and RADIUS?
Current DigiCert product documentation lists X.509v3 certificate and RADIUS authentication. Confirm that the required method is present in the selected edition and target build.
How much RAM does NanoSSH require?
The available product documentation does not provide one universal current RAM or flash figure. Measure the exact client or server configuration, cryptographic module, SFTP layer, algorithms, and compiler build.
Free tools Windows power users keep installed
One-click scans. No signup required.
Is NanoSSH FIPS validated?
Do not make that blanket claim. FIPS status depends on the exact validated cryptographic module, binary, operating mode, and deployment boundary; verify those details for the product you ship.
Can it expose a custom device CLI without a normal filesystem?
Yes in principle: the application supplies command handling, and SFTP can use a virtual filesystem backed by custom storage. The command authorization and filesystem callbacks remain your responsibility.
The Bottom Line
Choose NanoSSH when you need an embedded SSH client or server with vendor-backed integration, certificate or RADIUS options, SFTP, and specialized cryptographic modules across constrained targets. Choose OpenSSH or Dropbear when the product is already embedded Linux and open-source maintenance is acceptable. In every case, evaluate the exact build, license, interoperability matrix, key-storage design, authorization model, and recovery path—not just the protocol name.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
