4 ms·
SSH host certificates as somewhat of an abomination Many would say x509 is the real abomination.
by vaporary 3y ago
SSH host certificates as somewhat of an abomination
Many would say x509 is the real abomination.
- OrvalWintermute 3y agoI might not disagree with you there. However, for all its warts, x509 due to hardware implementations, seems a great deal more secure than sitting on the FS SSH host certificates.
- fmajid 3y agoOpenSSH supports FIDO keys since 8.2p1 and has supported smart cards via GPG longer.
- Reitet00 3y agoYeah. Actually ssh agent speaks PKCS#11 (both client and server) so it's possible to interface with the hardware token quite easily. I'm using that to store my client key in TPM for example.