In this lesson, you will learn how to automate the issuance of user-specific certificates to replace static SSH keys for more secure, ephemeral authentication.
From Static Keys to Automated Enrollment
Until now, you’ve likely managed SSH access by distributing static public keys into ~/.ssh/authorized_keys. This is a maintenance nightmare; if a laptop is stolen, you must manually rotate keys across every server. Automated Certificate Enrollment—using protocols like ACME (Automated Certificate Management Environment) or SCEP (Simple Certificate Enrollment Protocol)—allows users to request short-lived identity certificates. When a user authenticates, the server validates their certificate against a trusted Certificate Authority (CA) rather than checking a static list of keys.
Implementing the Workflow
To implement this, you designate an internal CA (like step-ca or HashiCorp Vault) and configure the client to request a certificate that acts as their "key."
- Request: The user runs a client-side agent (e.g.,
step ssh login) which authenticates the user (perhaps via your existing SSO/OIDC integration). - Issue: The CA verifies the user's identity and signs a temporary public key, returning a certificate valid for a few hours.
- Verify: You configure your SSH server to trust the CA’s public key via your
sshd_config:# Add to /etc/ssh/sshd_config TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem
Why This Matters for PAM
While SSH handles the certificate validation, you can integrate this into your broader identity strategy by having the CA verify group memberships before issuing the certificate. Because these certificates are time-limited, they inherently mitigate the risk of stale credentials. Even if a user leaves the organization, their certificate will expire automatically, and the CA will refuse to issue a renewal because the underlying identity lookup (via your previously studied SSSD/LDAP integration) will fail.
This shifts the security burden from manual file management to identity-based policy enforcement, ensuring that every login attempt is tied to a current, verified record in your centralized identity store.
Key Takeaway: Automated certificate enrollment replaces static, high-maintenance SSH keys with short-lived, CA-signed identity tokens, creating a more secure and revocable authentication lifecycle.