← All keys & policies
Key·organization
SSH certificate authority private key
Tier 0 · CriticalControl
Why Tier 0
Signs certificates for any member of the organization or enterprise that trusts it, so whoever holds it can push as anyone.
An organization or enterprise can trust an SSH CA, so members use short-lived certificates instead of personal SSH keys. The CA's private key signs those certificates.
Available on: Enterprise Cloud, EMU, Server. Source
Attack path
Short-lived certificates are a good control, but the CA key behind them is now the credential to protect. Whoever holds it can sign a certificate for any member and push as them. It lives outside GitHub, in whatever system issues the certificates.
Mitigations
- Keep the CA key in an HSM or a managed signing service
- Require an expiry on every certificate (upgrade legacy CAs that are exempt)
Detect
Alert on ssh_certificate_authority.create, ssh_certificate_requirement.disable in the audit log.