Lion Cipher Lab
Scale SSH beyond keys with a certificate authority
- Identity & Access Management
- Beginner
- ~45 min
- Free · no account required
Why it matters
Raw SSH keys work beautifully for one person and a handful of servers, and they fall apart at scale: every machine keeps its own authorized_keys file, so onboarding, offboarding, and key rotation mean touching every box by hand, and it is genuinely hard to answer 'who can log into what, and should they still?' A certificate authority replaces that sprawl with one trust anchor. The server trusts the CA, the CA signs a certificate that says who you are, which accounts you may use, and — critically — for how long. Short-lived certificates mean access expires on its own instead of lingering in a…
What you'll learn
- SSH certificate authorities
- signing user certificates
- signing host certificates
- TrustedUserCAKeys / HostCertificate
- short-lived credentials
- stopping trust-on-first-use prompts
Steps in this lab
- The problem keys leave behind: authorized_keys everywhere
- What an SSH certificate authority actually is
- Create your CA key pair (and guard it like gold)
- Sign a short-lived USER certificate
- Teach the server to trust the CA (TrustedUserCAKeys)
- Log in with the certificate and watch it expire
- Sign a HOST certificate to end the trust-on-first-use prompt
- Why short-lived certificates beat long-lived keys