Replace static SSH keys with SAML/OIDC-authenticated short-lived certificates. Eliminate authorized_keys management, key rotation, and orphan key cleanup. OnePAM issues certificates after IdP authentication — keys expire automatically.
Why SSH Keys Are a Security Risk
SSH key sprawl is one of the most pervasive and underestimated security risks in modern infrastructure. Organizations accumulate thousands of SSH keys across hundreds of servers — many belonging to departed employees, expired contractors, or forgotten service accounts. The authorized_keys file on each server becomes an unauditable access list that grows indefinitely. Rotating SSH keys at scale is operationally painful, so it rarely happens. The result: anyone with a stolen or leaked SSH key has persistent access to your servers indefinitely. OnePAM solves this by replacing static SSH keys with short-lived certificates issued after SAML/OIDC authentication. Users authenticate via your corporate IdP (Okta, Azure AD, Google Workspace), and OnePAM's built-in certificate authority issues a certificate valid for 1-24 hours. The certificate encodes the user's identity, group memberships, and access permissions. When it expires, access stops automatically. When a user is disabled in your IdP, they can no longer obtain certificates. No authorized_keys cleanup. No key rotation schedules. No orphan key risk.
Local Agent
The agent configures sshd to trust OnePAM's certificate authority. Users authenticate via IdP and receive short-lived certificates that sshd accepts natively. No authorized_keys needed.
Gateway SSH Proxy
The gateway authenticates users and manages SSH credentials on their behalf. Servers continue using key-based auth internally, but keys are managed by the gateway — not users.
The Dangers of SSH Key Sprawl
Without identity-based SSH access, these risks threaten your servers every day.
SSH Security Challenges
These are the risks organizations face with traditional SSH authentication.
Key Sprawl at Scale
Organizations with 100+ servers accumulate thousands of SSH keys. Each server's authorized_keys file grows with every new developer, contractor, and service account.
Impossible Auditing
SSH key fingerprints in authorized_keys don't tell you who the key belongs to, when it was added, or if it's still needed. Auditing is manual and incomplete.
No Expiration
SSH keys don't expire. A key created 5 years ago still works. There's no built-in mechanism for automatic access revocation.
Painful Rotation
Rotating SSH keys requires generating new key pairs, distributing public keys to every authorized server, and coordinating with every user. Most organizations never do it.
Offboarding Gaps
When employees leave, their SSH keys must be removed from every server they had access to. Missing even one server leaves a persistent backdoor.
No MFA Possible
SSH keys authenticate without MFA. If someone has the private key, they have full access. Adding MFA to key-based SSH is complex and fragile.
How OnePAM Replaces SSH Keys with Certificates
Step-by-step guide to deploying identity-based SSH access.
Deploy OnePAM Certificate Authority
OnePAM operates a built-in certificate authority (CA). Your servers trust the CA's public key.
Connect Your Identity Provider
Link your SAML 2.0 or OIDC Identity Provider. OnePAM uses IdP authentication to gate certificate issuance.
Users Authenticate and Get Certificates
When a user wants to SSH, they authenticate via the IdP. OnePAM issues a short-lived certificate.
SSH with Certificates
Users run 'onepam ssh' to connect. OnePAM obtains a certificate and establishes the SSH session.
Certificates Expire Automatically
When the certificate TTL expires, access stops. Users re-authenticate via the IdP to get a new certificate.
Benefits of Eliminating SSH Keys
What changes when you deploy identity-based SSH access.
Zero Key Management
No SSH keys to distribute, rotate, audit, or revoke. Certificates issued on-demand and expire automatically.
Zero authorized_keys entriesAutomatic Expiration
certificates expire after 1-24 hours. Access stops automatically. No orphan access, no lingering credentials.
Auto-expiring accessIdentity-Verified Access
Every certificate is tied to a corporate identity verified by your IdP. Know exactly who accessed which server.
100% identity-attributed accessInstant Offboarding
Disable a user in your IdP. They cannot obtain new certificates. Existing certificates expire within hours. Zero cleanup needed.
Zero offboarding effort for SSHMFA for Every Session
Certificate issuance requires IdP MFA. Every SSH session is MFA-protected. No per-server MFA configuration.
100% MFA-protected SSHCompliance-Ready
Certificate-based access provides the identity verification, access logging, and automatic revocation that SOC 2, HIPAA, and PCI DSS require.
Audit-ready from day oneSSH SSO Capabilities
Every feature needed for enterprise-grade SSH authentication.
Zero-Day Protection Features
Enterprise-grade security controls for SSH access.
SSH Key Replacement Use Cases
Common scenarios where organizations deploy OnePAM SSH SSO.
Replace SSH Keys with Identity-Based Access FAQ
Common questions about SSH SSO and zero-day protection.
How do certificates work?
Do users need to change their SSH workflow?
Can I use certificates for CI/CD pipelines?
What happens if OnePAM is unavailable?
Can I migrate gradually from SSH keys to certificates?
How are service accounts handled?
Replace SSH Keys with Identity-Based Certificates
Short-lived certificates tied to your corporate IdP.