# Does OTP's ssh daemon support SSH w/certificates? **URL:** \ **Category:** Questions / Help\ **Tags:** ssh\ **Created:** [November 19, 2022, 5:07pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061 "2022-11-19T17:07:11Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![rlipscombe](https://erlangforums.com/user_avatar/erlangforums.com/rlipscombe/32/459_2.png) [@rlipscombe](https://erlangforums.com/u/rlipscombe)\ **Post date:** [November 19, 2022, 5:07pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/1 "2022-11-19T17:07:11Z")
…and if so, how? ---
**Author:** ![ingela](https://erlangforums.com/letter_avatar_proxy/v4/letter/i/53a042/32.png) [@ingela](https://erlangforums.com/u/ingela)\ **Post date:** [November 29, 2022, 8:14am UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/2 "2022-11-29T08:14:11Z")
Do you mean X509 certificates as used with TLS (SSL)? Or do you mean OpenSSH “homebrew” simplified certificates? ---
**Author:** ![rlipscombe](https://erlangforums.com/user_avatar/erlangforums.com/rlipscombe/32/459_2.png) [@rlipscombe](https://erlangforums.com/u/rlipscombe)\ **Post date:** [December 13, 2022, 5:07pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/3 "2022-12-13T17:07:52Z")
I didn’t know there was a difference. I’ll do some more reading. What I’m looking for is a way to allow SSH to the console, using public key authentication, but without the need to keep authorized\_users synchronised across all nodes. _Ideally_, we’d integrate with something AWS-aware that handed out short-term (hours, rather than days) client certs. ---
**Author:** ![crownedgrouse](https://erlangforums.com/user_avatar/erlangforums.com/crownedgrouse/32/591_2.png) [@crownedgrouse](https://erlangforums.com/u/crownedgrouse)\ **Post date:** [December 13, 2022, 7:34pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/4 "2022-12-13T19:34:15Z")
See ssh\_server\_key\_api [https://www.erlang.org/doc/man/ssh\_server\_key\_api.html](https://www.erlang.org/doc/man/ssh_server_key_api.html) ---
**Author:** ![rlipscombe](https://erlangforums.com/user_avatar/erlangforums.com/rlipscombe/32/459_2.png) [@rlipscombe](https://erlangforums.com/u/rlipscombe)\ **Post date:** [December 13, 2022, 8:18pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/5 "2022-12-13T20:18:23Z")
I saw that, but it doesn’t seem to allow for checking a certificate chain. My thinking at the time was that we could just deploy a root cert to the nodes, and then validate the client cert against that. Kinda normal stuff (for TLS). Are you suggesting, instead, that I use the `is_auth_key` callback (which takes the client’s public key) and check that against … something else … that either holds a centralised copy of the public key, or that handed out the keypair in the first place…? Do you have any examples or documentation for how that might work…? ---
**Author:** ![crownedgrouse](https://erlangforums.com/user_avatar/erlangforums.com/crownedgrouse/32/591_2.png) [@crownedgrouse](https://erlangforums.com/u/crownedgrouse)\ **Post date:** [December 13, 2022, 8:58pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/6 "2022-12-13T20:58:27Z")
Default callback is [Erlang -- ssh\_file](https://www.erlang.org/doc/man/ssh_file.html) That use usual ssh certificates , with known\_host and authorized\_keys of system or user directory . Those directories can be changed as parameters if those files are coming with a release, for instance , or if user running vm does not have access to system ones. Be aware that openssl is used under the hood so usual security access must be respected. Creating a custom callback can be inspired of ssh\_file.erl ---
**Author:** ![crownedgrouse](https://erlangforums.com/user_avatar/erlangforums.com/crownedgrouse/32/591_2.png) [@crownedgrouse](https://erlangforums.com/u/crownedgrouse)\ **Post date:** [December 13, 2022, 9:07pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/7 "2022-12-13T21:07:24Z")
As reminder [How To Set Correct SSH Directory Permissions in Linux](https://www.tecmint.com/set-ssh-directory-permissions-in-linux/) ---
**Author:** ![crownedgrouse](https://erlangforums.com/user_avatar/erlangforums.com/crownedgrouse/32/591_2.png) [@crownedgrouse](https://erlangforums.com/u/crownedgrouse)\ **Post date:** [December 13, 2022, 9:12pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/8 "2022-12-13T21:12:33Z")
Important rsa is deprecated by default on recent otp releases . Add this in sys.config as workaround . > {ssh, [{modify\_algorithms, > [{append, [{kex,[‘diffie-hellman-group1-sha1’]}]} > ,{prepend, [{public\_key,[‘ssh-rsa’]}]} > ] > } > ] > } ---
**Author:** ![rlipscombe](https://erlangforums.com/user_avatar/erlangforums.com/rlipscombe/32/459_2.png) [@rlipscombe](https://erlangforums.com/u/rlipscombe)\ **Post date:** [December 13, 2022, 9:20pm UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/9 "2022-12-13T21:20:58Z")
You misunderstand. I know how to replace the implementation. I’m looking for examples where other people have done something like what I’m asking. Are there any walkthroughs/examples/documentation where people have used a custom callback to avoid deploying new authorized\_users in order to make changes? ---
**Author:** ![sg2342](https://erlangforums.com/user_avatar/erlangforums.com/sg2342/32/1233_2.png) [@sg2342](https://erlangforums.com/u/sg2342)\ **Post date:** [December 14, 2022, 12:52am UTC](https://erlangforums.com/t/does-otps-ssh-daemon-support-ssh-w-certificates/2061/10 "2022-12-14T00:52:47Z")
I am not aware of any code that adds OpenSSH certificate based authentication to the (server part of the) erlang ssh application. When i found nothing and tried to figure out what modifications to the ssh application would be needed to get this working i gave up at some point. However, i do have the code to operate on OpenSSH certificates in [my erlang SSH authentication agent application](https://github.com/sg2342/essh_agent) here: [essh\_pkt.erl](https://github.com/sg2342/essh_agent/blob/main/src/essh_pkt.erl), [essh\_cert.erl](https://github.com/sg2342/essh_agent/blob/main/src/essh_cert.erl) that might be of use.