Short-Lived SSH Certificate Authentication with HashiCorp Vault CA

1. SSH Certificate Authority Architecture vs Static Public Keys

Managing static ~/.ssh/authorized_keys files across production server fleets creates administrative burden and security risks. Decommissioned employees often retain access if public keys are not purged immediately.

SSH Certificate Authority (SSH-CA) replaces static public keys with cryptographically signed, short-lived certificates. Instead of maintaining authorized_keys files on every server, target SSH daemons are configured to trust the single Public Key of HashiCorp Vault CA.

When a developer logs in, Vault authenticates their identity via OIDC/SSO and issues an SSH user certificate valid for 8 hours. Once expired, the certificate becomes cryptographically invalid without manual revocation.

Configuring AuthorizedPrincipalsFile restricts target SSH logins to designated user roles.

This architecture provides central access management without requiring active database lookups during SSH handshakes.

Automated certificate expiration eliminates dormant key risk across cloud infrastructure.

Implementing automated continuous monitoring across production nodes ensures that compliance policies remain enforced during infrastructure updates.

Regular security audits should be integrated into DevOps CI/CD pipelines to verify that system configurations conform to zero-trust architecture standards.

Documenting system architecture and access control rules facilitates compliance verification during independent third-party security audits.

Enforcing strict runtime isolation boundaries prevents privilege escalation vectors across multi-tenant cloud environments.

# Configure /etc/ssh/sshd_config to Trust Vault SSH CA
TrustedUserCAKeys /etc/ssh/trusted-user-ca.pub

# Map authorized principals to local Linux accounts
AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u

2. Configuring HashiCorp Vault SSH Secrets Engine

Enable the SSH secrets engine in Vault, mount the CA role, and define allowed Linux user principals and maximum certificate TTL.

Restricting certificate TTL to 8 hours ensures credentials expire automatically at the end of a work shift.

Vault policies enforce least-privilege role mapping based on team membership.

Configuring Vault audit logs captures certificate serial numbers and requester IP addresses for compliance tracking.

Implementing automated continuous monitoring across production nodes ensures that compliance policies remain enforced during infrastructure updates.

Regular security audits should be integrated into DevOps CI/CD pipelines to verify that system configurations conform to zero-trust architecture standards.

Documenting system architecture and access control rules facilitates compliance verification during independent third-party security audits.

Enforcing strict runtime isolation boundaries prevents privilege escalation vectors across multi-tenant cloud environments.

# Enable SSH Secrets Engine in Vault
vault secrets enable -path=ssh-client-signer ssh

# Configure CA Keypair
vault write ssh-client-signer/config/ca generate_signing_key=true

# Export Vault CA Public Key for OpenSSH Hosts
vault read -field=public_key ssh-client-signer/config/ca > /etc/ssh/trusted-user-ca.pub

# Create Engineer Access Role
vault write ssh-client-signer/roles/devops \
    key_type=ca \
    allow_user_certificates=true \
    allowed_users="ubuntu,devops,admin" \
    default_user="devops" \
    ttl=8h \
    max_ttl=24h

3. Authenticating & Requesting Signed Certificates

Developers authenticate to Vault using CLI OIDC login and request a signed SSH certificate for their local public key.

The signed certificate is passed automatically to OpenSSH client connections.

Using Vault helper scripts automates certificate renewal seamlessly for developer workstations.

Integrating ssh-agent auto-loads short-lived certificates without manual file management.

Implementing automated continuous monitoring across production nodes ensures that compliance policies remain enforced during infrastructure updates.

Regular security audits should be integrated into DevOps CI/CD pipelines to verify that system configurations conform to zero-trust architecture standards.

Documenting system architecture and access control rules facilitates compliance verification during independent third-party security audits.

Enforcing strict runtime isolation boundaries prevents privilege escalation vectors across multi-tenant cloud environments.

# Authenticate via OIDC SSO
vault login -method=oidc

# Generate signed SSH certificate
vault write -field=signed_key ssh-client-signer/sign/devops \
    public_key=@~/.ssh/id_ed25519.pub > ~/.ssh/id_ed25519-cert.pub

# Connect to remote server using signed certificate
ssh -i ~/.ssh/id_ed25519-cert.pub -i ~/.ssh/id_ed25519 [email protected]

4. Verification & Certificate Audit Checklist

Inspect issued SSH certificates using ssh-keygen -Lf to verify valid principals, serial numbers, and expiration timestamps.

Audit OpenSSH daemon logs to verify that certificate logins recorded the signing CA key ID.

Ensure that target server clocks are synchronized via NTP to prevent certificate timestamp validation errors.

Regular security audits verify that Vault CA private keys remain strictly protected in HSM or KMS backends.

Implementing automated continuous monitoring across production nodes ensures that compliance policies remain enforced during infrastructure updates.

Regular security audits should be integrated into DevOps CI/CD pipelines to verify that system configurations conform to zero-trust architecture standards.

Documenting system architecture and access control rules facilitates compliance verification during independent third-party security audits.

Enforcing strict runtime isolation boundaries prevents privilege escalation vectors across multi-tenant cloud environments.

# Inspect signed SSH certificate details
ssh-keygen -Lf ~/.ssh/id_ed25519-cert.pub

# Audit SSH daemon certificate authentication in syslog
journalctl -u sshd | grep -i "Accepted certificate"

Written by Zyekh Abdul Qadir Jailani

Digital Forensics & Incident Response (DFIR) Specialist & Security Researcher specializing in Linux kernel hardening, threat hunting, and system security research.

LinkedIn • GitHub • Discord • Email • PGP Key