Q: SSH currently uses password authentication for access to production servers. Describe a certificate-based SSH authentication system for managing access to 1000+ servers without relying on password distribution or key rotation complexity.

Certificate-based SSH (using OpenSSH certificates) eliminates password management and simplifies key rotation across large deployments.

• CA Setup: Designate a secure certificate authority machine that signs user and host SSH keys. Generate a CA key pair:
• User Authentication: Instead of distributing individual keys, users request a signed certificate:
• User generates their personal key: ssh-keygen -t rsa -f ~/.ssh/id_rsa
• User submits their public key to the CA (via secure API or admin approval workflow)
• CA signs it with a time-limited validity: ssh-keygen -s /path/to/ca/ssh_ca -I user@example.com -n username -V +52w ~/.ssh/id_rsa.pub
• User receives a ~/.ssh/id_rsa-cert.pub valid for 52 weeks
• User connects: ssh -i ~/.ssh/id_rsa user@production-server
• Server Configuration: Add to /etc/ssh/sshd_config on all 1000 servers:

Architecture: Operational Scale: With 1000 servers, update /etc/ssh/user_ca.pub once on all servers (via configuration management like Ansible), and cert-based auth works network-wide without touching private keys.

ssh-keygen -t rsa -f /path/to/ca/ssh_ca

• Benefits:
• No password distribution or memorization
• Automatic expiration (no need to revoke individual keys; certificates naturally expire)
• Centralized revocation list (CRL) if needed
• Audit trail: Each certificate embeds username, timestamp, and approval details
• Zero-trust: Revoke CA instantly, all certificates become invalid without manual key cleanup