Advantages and Disadvantages of Certificate Authentication

Compared to public-key authentication, the principal advantage of using certificate authentication with Secure Shell is that it is much more scalable. Administrators do not have to trust individual public keys but only a small number of CAs (typically only one). Also, the users' access to several servers can be controlled by publishing certificate revocation lists for the CA.

Because certificate authentication is more scalable, it becomes a much more manageable form of authentication for medium to large scenarios. Provided that the CA implements sufficiently reliable identity establishment procedures, this may then in turn lead to increased security because user access is controlled from a central location. If a person leaves a company, it is not necessary to delete his public key from every server to which he has access in order to revoke the rights—instead the person's certificate is simply revoked by the company CA.

From the user's point of view, trusting a certain number of CAs and relying on them for assessing the credibility of other entities can be significantly easier than having to verify the identity of each remote entity manually. Furthermore, when certificates are used to authenticate the user, for example in a company network, there is no need for the user to distribute public keys, and the authentication can therefore become very easy to use. If the certificates and private keys are stored on smart cards, security is increased even further without making authentication more difficult. Certificates also have many more uses than a simple key pair, and the same certificate could be used for gaining access to the operating system, logging in to company file servers, and securing e-mail.

The actual security of certificate authentication depends the process of identity establishment employed by the CA. If the CA is not sufficiently trustworthy in verifying the identity of the entities enrolling certificates, the basis for trust is not sound. Care must also be taken when obtaining the CA certificate and verifying that the correct CA certificate has been downloaded.

The following lists sum up the advantages and disadvantages of using certificate authentication with SSH Tectia.

Advantages

No need to distribute public keys or validate fingerprints when creating or updating key pairs.
Authentication credentials can be centrally revoked.

Highly scalable: No need to trust individual entities, but only a single CA or a limited number of CAs.
Same or higher level of security compared to public-key authentication.
- User access to several servers can be controlled from one location, adding to security in some environments.
- Users can leave it to CAs to determine the trustworthiness of remote hosts, thus improving overall security if the CA is in a better position to evaluate their credibility.
Provides identity verification through secret private keys.
Non-interactive login is possible through an authentication agent.
Certificates can be used for many purposes such as login, access to file servers and e-mail security.

Disadvantages

Requires a public-key infrastructure (PKI). This can increase the cost of initial deployment in some environments when compared to public-key authentication.