OpenSSH can use
host certificates to verify the host (like SSL certs on a webserver).
OpenSSH can also use
user certificates to verify the user (like passwords or ssh keys).
Both these types of cert to be used independently of each other.
I've tested using user certificates to authorize user login, since that is what most
people do with keys. People never really verify the host identity.
It works great and it's actually very simple. This will be my new SOP going forward.
Before starting to add hosts and users you need to create a Certificate Authority (CA) - which is actually just a key pair. It's a one-liner.
Every time you create a new host, you just need to copy the same file to it - the public key of the CA. And change one line in sshd_config to allow ssh certificates.
Every time you have a new user on your team who need access to servers, you have to generate a certificate for him. It's a one liner. He will copy the certificate to his own machine. And the ssh client will automatically send the certificate when needed.
Generating certificates is the part that could be automated. You could for instance be given a certificate that expires in 5 minutes. That would allow you to login and stay logged in. But if you need to login again, you need to generate a new certificate.
