Skip to content

OpenSSH Certificates

ZestSSH supports OpenSSH certificate authentication, which uses certificates signed by a trusted Certificate Authority (CA) instead of raw public keys. This simplifies key management in larger environments.

Availability: Free tier — All platforms

With certificate authentication:

  1. A Certificate Authority (CA) signs user keys, producing a certificate.
  2. The server is configured to trust the CA instead of individual public keys.
  3. Any key signed by the trusted CA is accepted without being listed in authorized_keys.

This eliminates the need to distribute individual public keys to every server.

  1. Have your SSH CA sign your public key to produce a certificate file (e.g., id_ed25519-cert.pub).
  2. Import both the private key and its associated certificate into ZestSSH.
  3. Configure the connection to use the key with the certificate.
  4. The server validates the certificate against its trusted CA and grants access.

Certificate authentication is most useful in:

  • Organizations managing many servers and users.
  • Environments where public key distribution is impractical.
  • Short-lived access scenarios where certificates have expiration dates.

For personal use or small environments, standard public key authentication is usually simpler.