If you’re not using SSH certificates you’re doing SSH wrong
So naive, so wrong. It&#x27;s hard to know where to start.<p>&gt; Operating SSH at scale is a disaster. Key approval &amp; distribution is a silly waste of time. Host names can’t be reused. Homegrown tools scatter key material across your fleet that must be cleaned up later to off-board users.<p>Outright lie or incompetence at worst, or a &quot;my salary depends on not understanding this&quot; case at best, being demonstrated here. Even if you don&#x27;t have chef&#x2F;puppet&#x2F;etc managing at least some level of fleet configuration (if you don&#x27;t, your org is hopeless anyway and ssh-at-scale is not a first problem to solve), it&#x27;s oh-so-easy to put just your pubkeys somewhere (S3, eg) and manage them via, say, git.<p>Next problem is that openssh-style certs do not support cert chains. So you cannot revoke an intermediate. A huge aspect of PKI is that you must be able to recover from a compromise. The rest of this point is left as an exercise for the reader.<p>You have to secure the CA! You have to properly authorize signing requests! These things fall into the realm of hard.