Use your password and the code from your authenticator app.
~/.ssh/{{ signed.file }}Put it next to the private key you just signed, and ssh will use it automatically.
{{ signed.cert }}
Save this public key as /etc/ssh/user_ca.pub on each server and point TrustedUserCAKeys at it. The server will then accept every certificate signed here.
{{ me.ca.key }}
No certificates yet. Sign your first key above.
They are shown only once. Use a private channel, such as a password manager's sharing feature. In an authenticator app that asks for a key, such as Authy, paste the secret and choose 6-digit codes.
The site generates their password and authenticator secret, and shows them to you once.
This site is a certificate authority for SSH. Instead of copying each device's public key into authorized_keys on every server, every server trusts a single CA key. This site uses that key to sign your devices' public keys, and the signed result is a short-lived SSH certificate.
On a new device, create a key pair with ssh-keygen -t ed25519 and paste the contents of the .pub file into the dashboard. The private key never leaves the device; only the public half is uploaded. The site signs it with the user CA for the usernames your account is allowed to log in as, and for between one and thirty days.
Save the certificate next to the private key, for example as ~/.ssh/id_ed25519-cert.pub. ssh finds it there and presents it automatically, so ssh root@server works without any extra options. When the certificate expires, sign the same key again.
Each server needs the CA's public key, saved as /etc/ssh/user_ca.pub, and a TrustedUserCAKeys line in its sshd configuration that points at it. The dashboard can copy or download that key for you. From then on the server accepts any unexpired certificate signed by this CA, provided the username you log in as is one the certificate allows. Adding a new device never requires touching the servers.
Revoking bans the device's public key itself rather than a single certificate, so every certificate ever issued for that key stops working, and the site refuses to sign it again. A lost device therefore needs a new key, not just a new certificate.
The list of banned keys is published at /revoked_keys, the one address that doesn't require a login. Each server downloads it every five minutes, and sshd refuses any key on it through its RevokedKeys setting. A revocation therefore takes effect on every server within five minutes.
Each account has a list of server usernames, and every certificate it signs allows exactly those. Admins can add accounts from the Users page; the site generates the new account's password and authenticator secret and shows them once. Removing an account ends its sessions and revokes every key it ever had signed, so its access to the servers ends within five minutes rather than when its certificates expire. If every admin is locked out, running ssh-ca-web adduser as root on the CA server creates or resets an admin.
The app listens only on the server's loopback address and is reachable only through a Cloudflare Tunnel, with Cloudflare Access checking your identity before any request arrives. After that, logging in takes both a password and a code from your authenticator app, and each code works only once. Five failed logins from one address block it for fifteen minutes, and a session lasts twelve hours.
The CA's private key stays on the server in /etc/ssh-ca, readable only by root, and never leaves it. Every login, signature, revocation and change to an account is recorded in the server's system journal.