SSH certificates
An authority whose certificates last minutes, so there is nothing durable to steal and nothing to revoke.
cardinal ssh ca init -activate # create the authority, print its public half
cardinal ssh ca trust # the full TrustedUserCAKeys contents
cardinal ssh ca list # keys, and which one signs
cardinal ssh ca rotate <key-id> -grace 168h
Certificates live ten minutes by default: short enough that a stolen one is not durable access, long enough to finish what you started. It is configurable per issuance for the cases that genuinely differ.
Rotation is additive
The new key signs, the previous one stays trusted for the grace period, and
nothing on the fleet has to be updated in lockstep. cardinal-agent writes the
trusted authorities with an sshd drop-in naming them, so rotating is not a
fleet-wide manual step.
No revocation list, and why that is livable
There is none, for either certificate kind. The answer to a compromised SSH certificate is that it expires in minutes. That is a real trade: it means a compromise inside the window cannot be cut short, and it means issuance has to be available.
Host certificates too
Hosts get certificates as well as users, so an @cert-authority line lets a
client verify the machine rather than accepting a fingerprint nobody checks.
This is the visible early win of enrolling a fleet: TOFU warnings stop, fleet-wide.
In the console
Authorities shows both authorities, which key is signing, and the trust bundle with a button to copy it, the thing you actually want from a browser, because it has to be pasted into configuration management.
The page is read-only. Creating an authority, rotating one and issuing certificates are CLI-only.