# Ensure Implement and Manage SSH Certificate-Based Authentication

- Source: https://support.icompaas.com/support/solutions/articles/62000235290-ensure-implement-and-manage-ssh-certificate-based-authentication
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:  
** **Level 1**

**Description:  
** The organization must provide and manage SSH certificates as a method of authenticating users accessing servers and infrastructure. SSH certificates offer a scalable and secure alternative to static SSH keys by enabling centralized issuance, expiration, and revocation of user credentials.

**Rationale:  
** Using SSH certificates enhances security by reducing the risks associated with unmanaged SSH keys, such as key sprawl, lost keys, or unauthorized access. Centralized certificate management simplifies access control, supports auditing, and aligns with security best practices.

**Impact**:  
 **Pros**:

-   Improves access control through centralized issuance and revocation.  
      
    
-   Reduces risk of unauthorized server access.  
      
    
-   Simplifies SSH key lifecycle management.  
      
    
-   Enhances auditability of access events.  
      
    

**Cons**:

-   Requires initial setup and operational overhead.  
      
    
-   Needs training for administrators and users on certificate usage.  
      
    

**Default value:  
** Many organizations rely on static SSH keys without certificate management, increasing security risks.

**Audit**:  
 Verify deployment and use of SSH certificates across servers. Review issuance, expiration, and revocation logs. Check for legacy unmanaged SSH keys.

**Remediation:  
** Implement an SSH certificate authority (CA) and establish policies for certificate issuance and management. Train users on certificate usage and integrate certificate validation in SSH servers.

**References**:

1.  [https://www.openssh.com/manual.html  
      
    ](https://www.openssh.com/manual.html)
    
2.  [https://developers.cloudflare.com/ssh-tunnel/ssh-certificates/  
      
    ](https://developers.cloudflare.com/ssh-tunnel/ssh-certificates/)
    
3.   [https://www.cisecurity.org/controls/application-software-security/](https://www.cisecurity.org/controls/application-software-security/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.