Enterprise and organization admins can now register their SSH certificate authorities with GitHub, helping their team access repositories over Git using SSH certificates.
Overview
GitHub Enterprise Cloud now supports SSH certificates, enabling organizations to enhance control over repository access. By allowing a single SSH key to sign others, this feature provides a more secure and manageable authentication method for developers.
What You'll Learn
1
How to set up an SSH Certificate Authority for GitHub Enterprise Cloud
2
Why SSH certificates enhance security for repository access
3
When to require SSH certificates for accessing repositories
Key Questions Answered
What is the difference between SSH certificates and SSH keys?
SSH certificates differ from SSH keys in that they allow one SSH key to sign another, creating a certificate that can be verified by a trusted Certificate Authority (CA). This enhances security by enabling organizations to manage access more effectively, as the CA can issue certificates with specific metadata about the developer.
How does an organization set up SSH certificate authentication?
To set up SSH certificate authentication, an organization first uploads their SSH CA key, which is a standard SSH key. They then issue certificates for their members, allowing them to access repositories without needing to upload individual SSH keys to their accounts.
What security policies can be implemented with SSH certificates?
SSH certificates allow organizations to enforce sophisticated security policies, such as daily expiration of certificates. This means developers must fetch new certificates regularly, ensuring that access is tightly controlled and limited to specific time frames.
Technologies & Tools
Protocol
SSH
Used for secure access to repositories through certificate authentication.
Key Actionable Insights
1Implementing SSH certificate authentication can significantly enhance your organization's security posture.By requiring SSH certificates for repository access, organizations can ensure that only authorized developers can authenticate, thus reducing the risk of unauthorized access.
2Regularly updating and managing SSH certificates can streamline access control.Setting certificates to expire daily encourages developers to renew their access frequently, which can help in maintaining tighter security and compliance with organizational policies.
Common Pitfalls
1
Failing to configure the SSH Certificate Authority correctly can lead to access issues.
If the CA is not properly set up or the public key is not uploaded correctly, members may be unable to authenticate, leading to disruptions in workflow.
Related Concepts
SSH Authentication
Certificate Authorities
Access Control Policies