We need better support for SSH host certificates
Yes! SSH certificates are awesome, both for host- and client-verification.<p>Avoiding Trust on First Use is potentially a big benefit, but the workflow improvements for developers, and especially non-technical people, is a huge win too.<p>At work, we switched to Step CA [1] about 2 years ago. The workflow for our developers looks like:<p><pre><code>  1. `ssh client-hosts-01`

  2. Browser window opens prompting for AzureAD login

  3. SSH connection is accepted
</code></pre>
It really is that simple, and is extremely secure. During those 3 steps, we've verified the host key (and not just TOFU'd it!), verified the user identity, and verified that the user should have access to this server.<p>In the background, we're using `@cert-authority` for host cert verification. A list of "allowed principals" is embedded in the users' cert, which are checked against the hosts' authorized_principals [2] file, so we have total control over who can access which hosts (we're doing this through Azure security groups, so it's all managed at our Azure portal). The generated user cert lasts for 24 hours, so we have some protection against stolen laptops. And finally, the keys are stored in `ssh-agent`, so they work seamlessly with any app that supports `ssh-agent` (either the new Windows named pipe style, or "pageant" style via winssh-pageant [3]) - for us, that means VSCode, DBeaver, and GitLab all work nicely.<p>My personal wishlist addition for GitHub: Support for `@cert-authority` as an alternative to SSH/GPG keys. That would effectively allow us to delegate access control to our own CA, independent of GitHub.<p>[1] <a href="https://smallstep.com/docs/step-ca" rel="nofollow">https://smallstep.com/docs/step-ca</a><p>[2] <a href="https://man.openbsd.org/sshd_config#AuthorizedPrincipalsFile" rel="nofollow">https://man.openbsd.org/sshd_config#AuthorizedPrincipalsFile</a><p>[3] <a href="https://github.com/ndbeals/winssh-pageant">https://github.com/ndbeals/winssh-pageant</a>