Hacker News Reader

Comment by szszrk | Hacker News Reader

I would love to ask you lovely HN people, assuming you actually use SSH for work:

- does you organization use ssh certs?

- how big is the org? ("I know most IT", or "it's impossible to know the whole IT"?)

- were you the ones that proposed and implemented that change? :)

SSH certs make so much sense and I know about them for a long time. Yet never implemented that approach - we had at most 2 people that were actually interested. And now for me everything is http API's and oauth, so I don't need it any more. I wonder what are reasons orgs don't use ssh certs by default.

View on HN

We implemented it at a previous company, but it was a managed services provider that had access to customer VM's or other infrastructure. It was part of the soc2 process to "approve, audit, and then grant timed access" to various infra.

Everywhere else I worked just used ssh keys, either deployed via ansible or via LDAP because it's so much more simple unless there's a high need for an audit trail with proof of approval. SSH keys scale perfectly fine otherwise.

Unless I'm desperate, I'll never work for a managed services company again, so hopefully I'll never need to bother.

Hey! Co-founder of Infisical here.

I'd say SSH certificate-based authentication is implemented widely at big tech and larger enterprises (tons of sources on it) but hasn't received the same mainstream adoption as SSH public key authentication because the administrative experience to set it up can be quite cumbersome despite how much benefit it provides. Put differently, there's always been a tradeoff in terms of configuration effort and benefits reaped.

With Infisical SSH, we've tried to abstract away as much complexity as possible and give folks the ability to implement a SSH certificate-based access scheme across infrastructure with minimal administrative overhead.

I have never met anyone who used certs with ssh, despite being the obvious choice.

But since apparently ssh is now obsolete (as I was told here a week ago or so) maybe it makes no difference.

I will throw it in the bin with other obsolete tech from at least 40+ years ago.

Like NFS.

Oh, wait.

I'd say ssh is here to stay far more than NFS.

Reply on news.ycombinator.com