SSH logins in practice: certificates vs. OPKSSH#

Erich Birngruber

• Why: SSH access at scale with unmanaged clients is an identity problem most enterprises have and few solve well — private keys on unmanaged endpoints, server-side key sprawl, awkward MFA. This is a hands-on comparison of the two leading answers from a real multi-user cluster evaluation.
• What: OpenSSH certificates versus OpenPubKey/OPKSSH, evaluated for a compute cluster of dozens of machines and hundreds of unmanaged clients, with live demos of both from client and server perspectives (lab environment: Kanidm as IDM/OAuth provider, step-ca as CA).
• How: Both deliver short-lived credentials via an OAuth flow. Certificates add host validation and stay within core SSH features (forwarding, agent control), but require CA setup and lifecycle. OPKSSH offers highly customizable policies (including claims-based) and works with multiple existing IdPs, but does not cover host verification — you need a third-party tool beyond the SSH client for that.
• Where applicable: Any multi-user SSH estate, HPC clusters, and organizations wanting OAuth-bound short-lived SSH access. The comparison table is a useful decision matrix if you're weighing these two today.