tl;dr: In certificate based SSH authorization, is there any benefit to keeping host certificates lifespan short? Do you gain anything by renewing them periodically?
Recently I have been exploring SSH access through certificates, as opposed to the traditional means of access through public key authentication.
To me, certificate based authentication makes a lot of sense in terms of scalability and security, especially when paired with some kind of authorization with an identity platform like Active Directory. Making short lived user certificates eliminates the need for one to keep track of where their public keys live and creates narrower attack windows for any malicious actors. However, one pattern that I have seen a couple of times now is also creating short lived host certificates that are periodically renewed.
While I understand that host certificates are great because they can eliminate TOFU related issues, I am struggling to understand why I am seeing the pattern of short lifespans with frequent renewal. If anyone has insight to scenarios where this would be useful, I would greatly appreciate the explanation.
Note: Just to eliminate any ambiguity, what I mean by
host certificates is as follows:
user: The certificate belonging to the client which initiates the SSH connection.
host: The certificate belonging to the server which is the target for the SSH connection.