I'm struggling to understand what the difference between SSH host keys and certificates is. When to use which ? How do they differ?

1 Answer 1


With an SSH host key the client has to already trust the host or has to accept the fingerprint on the initial contact - of course only after validating that the fingerprint matches the expected one. When using a certificate the host key is instead put inside this certificate and the additional features of the certificate like subject, issuer and signature of the issuer make it possible to derive trust into an yet unknown host key from trusting the issuer. It also makes it possible to have a limited life time of the host key and to revoke it. Essentially using a certificate makes using a PKI possible which make everything more scalable.

If you understand how certificate validation works in the browsers you can also compare it to self-signed certificate vs. CA issued certificates: the simple host key is comparable to a self-signed certificate, where one explicitly needs to add the trust to each browser. The host key inside a certificate together with a PKI is instead similar to the CA issued certificates we have in almost all cases when accessing a https-URL. In these cases the trust in the server certificate is derived from the trust in the root CA's located in the trust store of the browser or OS, i.e. only these root CA needs to be known up-front but not each server certificate.

  • But what when I use self signed certificates? Is there any difference (for example in the format?)
    – cyzczy
    Commented Jul 14, 2017 at 13:15
  • 1
    @adam86: there is a difference in format between having the key in SSH host key format and having the key wrapped inside a certificate. But there is not really a difference in functionality. Commented Jul 14, 2017 at 13:19
  • Thank you. So basically you use either a host key or certificate, you can't both, right ? And also, similarly to HTTPS, this cert / key is used to authenticate the server we try to connect too, right ?
    – cyzczy
    Commented Jul 14, 2017 at 13:23
  • @adam86: yes and yes. Commented Jul 14, 2017 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .