SSH certificate authority for teams
Replace scattered authorized_keys files with short-lived SSH certificates. Invite people by email, enrol servers with one command, renew automatically when you connect, and take access away in minutes.
Create an organisation, add environments and departments, and invite people by email. Choose which server accounts each person may use.
Add a server and run the command we give you. The server trusts your CA and checks who may log in every five minutes.
sshking-server enroll …People approve a code in the browser once. After that, ssh fetches a fresh short-lived certificate by itself. No keys to copy to servers, ever.
sshking-user loginUser certificates last hours, not years. A lost laptop stops working by itself.
A plain ssh renews the certificate when it runs low. Ask people to confirm in the browser as often as each organisation, environment or server requires.
Choose who logs in as which account and who gets sudo. Servers create missing accounts and update sudo within five minutes.
Take someone out of a department and every server in it refuses them within five minutes, even before their certificate expires.
New CA keys are published before they sign, and old ones stay trusted until their last certificate expires. Or rotate and revoke at once if a key leaks.
Grant access to an organisation, an environment, a department or a single server, as member or admin.
Servers present host certificates too, so nobody types yes to an unknown fingerprint again.
Each invitation, certificate, rotation and removal lands in the audit log for your organisation.
A CA signs SSH keys for a limited time. Servers trust the CA instead of a list of keys, so access is granted by issuing a certificate and ends when it expires, with no authorized_keys files to keep in sync.
authorized_keys entries never expire and live on every server. With SSHKing, people get certificates that last hours, access is managed in one place, and removing someone takes effect on every server within five minutes.
Any server you enrol to accept certificate logins. People, organisations and environments are not counted. The 100 free servers are shared by all organisations you create.
No. Enrolment adds certificate logins next to authorized_keys. Remove the old keys when you are ready.
OpenSSH and curl. The sshking-user helper is a small shell script that works on macOS and Linux.
Encrypted in the database with a master key that only the service holds. A key that stops signing is destroyed.