Explains how certificates, certificate authorities, and public-private key pairs authenticate SSH servers and users while avoiding the transmission of reusable passwords over the network.
SSH certificate and public-key authentication is an identity-verification model that
-
uses possession of a private key to prove an identity
-
uses a stored public key or a trusted certificate authority to verify that proof, and
-
can authenticate a server, a user, or both endpoints of an SSH connection.
X.509v3 authentication uses certificates issued through public-key infrastructure. OpenSSH certificate authentication uses certificates signed with an SSH CA key. Direct public-key authentication stores a user's public key on the SSH server.
Authentication choices
-
Use X.509v3 certificates when the deployment uses X.509 trustpoints, identity certificates, and certificate revocation lists.
-
Use OpenSSH certificates when an OpenSSH CA signs router and user SSH certificates.
-
Use direct public-key authentication when a router acting as a client or server must authenticate locally configured users by key pair.