Ephemeral SSH Keys

The SSH keys living in your $HOME/.ssh are practically immortal. You create id_ed25519 once, copy its public half to a target host and insert it into authorized_keys, and retain access for years. The private key lives on a laptop, in backups, and often on machines which have long since stopped being used. That is convenient, but it makes for an unpleasant authorization model. When someone leaves the company or a team, every relevant host must be changed. If a laptop is lost, someone must know where its key is authorized. And authorized_keys becomes a distributed, hard-to-audit identity database. A better separation is to stop having hosts trust every individual user key. Instead, they trust a small number of SSH certificate authorities (CAs). A CA issues an SSH certificate for a fresh, short-lived key. The certificate might be valid for only 25 hours. Its private key lives solely in ssh-agent and then disappears. It is never materialized on a developer’s laptop disk. This is not a new…