frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

SSH certificates: the better SSH experience

https://jpmens.net/2026/04/03/ssh-certificates-the-better-ssh-experience/
38•jandeboevrie•4h ago

Comments

thomashabets2•1h ago
Every couple of months someone re-discovers SSH certificates, and blogs about them.

I'm guilty of it too. My blog post from 15 years ago is nowhere near as good as OP's post, but if I though me of 15 years ago lived up to my standards of today, I'd be really disappointed: https://blog.habets.se/2011/07/OpenSSH-certificates.html

kaoD•1h ago
I've known SSH certs for a while but never went through the effort of migrating away from keys. I'm very frustrated about manually managing my SSH keys across my different servers and devices though.

I assume you gathered a lot of thoughts over these 15 years.

Should I invest in making the switch?

ibotty•47m ago
Yes. Caveat: It might not really be worth it if all your infrastructure is managed by these newfangled infrastructure-as-code-things that are quick to roll out (OpenShift/OKD, Talos, etc.) and you have only one repo to change SSH keys (single cluster or single repo for all clusters).

There are some serious security benefits for larger organizations but it does not sound as if you are part of one.

thomashabets2•3m ago
If your use case is such that you are frustrated about managing keys, host or user keys, then yes it does sound like SSH certs would help you. E.g. when you have many users, servers, or high enough cartesian product of the two.

In environment where they don't cause frustration they're not worth it.

Not really more to it than that, from my point of view.

papyDoctor•6m ago
Another useful feature of SSH certificates is that you can sign a user’s public key to grant them access to a remote machine for a limited time and as a specific remote user.
Thom2000•1h ago
Sadly services such as Github don't support these so it's mostly good for internal infrastructure.
lights0123•26m ago
They do, for Enterprise customers only: https://docs.github.com/en/enterprise-cloud@latest/organizat...

They've rolled their host key one time, so there's little reason for them to use it on the host side.

linsomniac•43m ago
In our dev/stg environment we reinstall half our machines every morning (largely to test our machine setup automation), and SSH host certificates make that so much nicer than having to persist host keys or remove/replace them in known_hosts. Highly recommended.
Tepix•30m ago
The author lists all the advantes of CA certificates, yet doesn't list the disadvantages. OTOH, all the many steps required to set it up make the disadvantages rather obvious.

Also, I've never had a security issue due to TOFU, have you?

adrian_b•8m ago
TOFU is convenient, but not necessary.

Choosing to use TOFU is a distinct choice from the choice of using the keys generated by SSH, instead of using certificates.

If you do not want to use TOFU, for extra security, you just have to pair the computers by copying between them the corresponding public keys through a secure channel, e.g. by using a USB memory.

Using certificates does not add any simplification or any extra security.

For real security, you still must pair the communicating computers by copying between them the corresponding certificates, through a secure channel, e.g. a USB memory.

When you use for HTTPS the certificates that have come with your Internet browser, you trust that the installer package for the browser has come to that computer through a secure channel from the authority that has created the certificates. This is usually an assumption much more far fetched than the assumption that you can trust TOFU between computers under your control.

Show HN: I built a frontpage for personal blogs

https://text.blogosphere.app/
158•ramkarthikk•2h ago•67 comments

Big-Endian Testing with QEMU

https://www.hanshq.net/big-endian-qemu.html
13•jandeboevrie•1h ago•2 comments

Show HN: ctx – an Agentic Development Environment (ADE)

https://ctx.rs
13•luca-ctx•53m ago•5 comments

April 2026 TLDR Setup for Ollama and Gemma 4 26B on a Mac mini

https://gist.github.com/greenstevester/fc49b4e60a4fef9effc79066c1033ae5
139•greenstevester•5h ago•50 comments

Samsung Magician disk utility takes 18 steps and two reboots to uninstall

https://chalmovsky.com/2026/03/29/samsung-magician.html
91•chalmovsky•4d ago•28 comments

Google releases Gemma 4 open models

https://deepmind.google/models/gemma/gemma-4/
1626•jeffmcjunkin•22h ago•429 comments

Show HN: Apfel – The free AI already on your Mac

https://apfel.franzai.com
380•franze•5h ago•80 comments

A Recipe for Steganogravy

https://theo.lol/python/ai/steganography/seo/recipes/2026/03/27/a-recipe-for-steganogravy.html
27•tbrockman•5d ago•6 comments

What Category Theory Teaches Us About DataFrames

https://mchav.github.io/what-category-theory-teaches-us-about-dataframes/
81•mchav•5d ago•19 comments

Decisions that eroded trust in Azure – by a former Azure Core engineer

https://isolveproblems.substack.com/p/how-microsoft-vaporized-a-trillion
976•axelriet•22h ago•435 comments

ESP32-S31: Dual-Core RISC-V SoC with Wi-Fi 6, Bluetooth 5.4, and Advanced HMI

https://www.espressif.com/en/news/ESP32_S31_Release
119•topspin•5d ago•64 comments

TDF ejects its core developers

https://meeksfamily.uk/~michael/blog/2026-04-02-tdf-ejects-core-devs.html
72•janvdberg•2h ago•55 comments

NHS staff refusing to use FDP over Palantir ethical concerns

https://www.freevacy.com/news/financial-times/nhs-staff-refusing-to-use-fdp-over-palantir-ethical...
175•chrisjj•5h ago•55 comments

Critics say EU risks ceding control of its tech laws under U.S. pressure

https://www.politico.eu/article/fatal-decision-eu-slammed-for-caving-to-us-pressure-on-digital-ru...
119•nickslaughter02•3h ago•71 comments

Bun: cgroup-aware AvailableParallelism / HardwareConcurrency on Linux

https://github.com/oven-sh/bun/pull/28801
15•tosh•3h ago•4 comments

What we learned building 100 API integrations with OpenCode

https://nango.dev/blog/learned-building-200-api-integrations-with-opencode/
44•rguldener•3d ago•6 comments

SSH certificates: the better SSH experience

https://jpmens.net/2026/04/03/ssh-certificates-the-better-ssh-experience/
40•jandeboevrie•4h ago•11 comments

Intel Assured Supply Chain Product Brief

https://www.intel.com/content/www/us/en/content-details/850997/intel-assured-supply-chain-product...
23•aw-engineer•4d ago•1 comments

Tailscale's new macOS home

https://tailscale.com/blog/macos-notch-escape
506•tosh•20h ago•257 comments

Claude 4.6 Jailbroken

https://github.com/Nicholas-Kloster/claude-4.6-jailbreak-vulnerability-disclosure-unredacted
4•NuClide•1h ago•1 comments

The True Shape of Io's Steeple Mountain

https://www.weareinquisitive.com/news/hidden-in-the-shadow
88•carlosjobim•5d ago•2 comments

Artemis II's toilet is a moon mission milestone

https://www.scientificamerican.com/article/artemis-iis-toilet-is-a-moon-mission-milestone/
293•1659447091•1d ago•129 comments

Cursor 3

https://cursor.com/blog/cursor-3
477•adamfeldman•20h ago•353 comments

Qwen3.6-Plus: Towards real world agents

https://qwen.ai/blog?id=qwen3.6
561•pretext•1d ago•194 comments

Good ideas do not need lots of lies in order to gain public acceptance (2008)

https://blog.danieldavies.com/2004/05/d-squared-digest-one-minute-mba.html
307•sedev•21h ago•149 comments

C89cc.sh – standalone C89/ELF64 compiler in pure portable shell

https://gist.github.com/alganet/2b89c4368f8d23d033961d8a3deb5c19
162•gaigalas•2d ago•52 comments

Category Theory Illustrated – Types

https://abuseofnotation.github.io/category-theory-illustrated/06_type/
10•boris_m•4h ago•0 comments

LinkedIn is searching your browser extensions

https://browsergate.eu/
1821•digitalWestie•1d ago•730 comments

New Rowhammer attacks give complete control of machines running Nvidia GPUs

https://arstechnica.com/security/2026/04/new-rowhammer-attacks-give-complete-control-of-machines-...
98•01-_-•6h ago•5 comments

Vector Meson Dominance

https://johncarlosbaez.wordpress.com/2026/03/29/vector-meson-dominance/
44•chmaynard•5d ago•4 comments