Poll HN: Do you use SSH certificates (not mere public-key authentication)?

Do you use SSH certificates for work and/or personal SSH logins?

I have just switched, for my personal machines, but dealing with the CA keys is a royal pain.

What on earth do people to do keep their CA keys accessible but secure?

(You can choose multiple options below)

I've used public-key basically forever.

I have wanted to go that step further and implement certificates for a good few years now, I absolutely see the value, no question about it (i.e. no more out of date authorized_keys files, no need to even install authorized_keys files in the first place, the list goes on).

I wish YubiKeys were more flexible in allowing SSH certificates to be hosted on them (currently can only host X509 type). Because if I could use a Yubi for SSH certificate signing I would have already been using certificates ! (Yes I know, theoretically you can do it with GPG keys, but frankly that's a PITA with many issues).

My current plan is to take inspiration from this : https://smallstep.com/blog/diy-single-sign-on-for-ssh/

What's the difference between a certificate and a public/private keys?

You can use this great-but-also-terrible system to do X509 certificate validation with SSH: https://github.com/mjg59/ssh_pki Maybe after some deeper security analysis this idea could help you work around the limitations of Yubikey's hardware.

However, if the author of a piece of security software tells me something is a bad idea, I tend to accept that, especially if that author is mjg59.

You add the intermediate key to config for trust. You do not need authorized_keys files for each user. Good for team and central management and faster key rotation but then needs trusted intermediate authority which is secure. No password or key rotation on machine itself which is good if you have a lot of machines.