> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH certificate dynamic secrets

> Learn how to dynamically generate short-lived SSH certificates.

The Infisical SSH dynamic secret allows you to generate ephemeral SSH certificates on demand, signed by an auto-generated Certificate Authority (CA). Instead of distributing static SSH keys, each lease produces a short-lived private key and a signed certificate that expires automatically.

## How it works

When you create an SSH dynamic secret, Infisical generates an internal CA key pair. Target hosts are configured to trust this CA. When a lease is requested, Infisical generates an ephemeral key pair, signs the public key with the CA, and returns the private key and signed certificate. The certificate expires when the lease TTL ends so no manual key rotation or revocation is required.

## Set up dynamic secrets with SSH

**1. Open Secret Overview Dashboard**

Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret.

![Add Dynamic Secret Overview](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/secret-overview-dashboard.png)

**2. Click on the 'Add Dynamic Secret' button**

![Add Dynamic Secret Button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/add-dynamic-secret-button.png)

**3. Select 'SSH'**

Select **SSH** from the dynamic secret type list.

![Select SSH](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/select-ssh-provider.png)

**4. Provide the inputs for dynamic secret parameters**

**Secret Name** `string` *required*

Name by which you want the secret to be referenced

**Default TTL** `string` *required*

Default time-to-live for a generated certificate (e.g. `1h`, `8h`, up to `7d`)

**Max TTL** `string` *required*

Maximum time-to-live for a generated certificate (e.g. `24h`, up to `7d`)

**Allowed Principals** `list` *required*

The usernames this dynamic secret can issue certificates for (e.g. `ubuntu`, `deploy`, `root`). When creating a lease, the requester selects a subset of these principals.

**Key Algorithm** `string` *required*

Algorithm for the ephemeral key pairs generated per lease. Supported options: **ED25519** (default, recommended), **RSA 2048**, **RSA 4096**, **ECDSA P-256**, **ECDSA P-384**.

**CA Key Algorithm** `string` *required*

Algorithm for the internal CA key pair that signs lease certificates. Supported options: **ED25519** (default, recommended), **RSA 2048**, **RSA 4096**, **ECDSA P-256**, **ECDSA P-384**. Changing this after creation generates a new CA, so hosts that trust the previous CA must be set up again.

![SSH Form](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/ssh-configuration-form.png)

**5. Click 'Submit'**

After submitting the form, a **Certificate Authentication Setup** modal will appear with two options for configuring target hosts to trust the CA:

* **Automated setup**: A `curl | sudo bash` command that installs the CA certificate, configures `TrustedUserCAKeys` in `sshd_config`, and restarts the SSH service.
* **Manual setup**: The raw CA public key, which you can reveal and copy to install manually on target hosts.

  ![CA Setup Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/ca-setup-modal.png)

> [!NOTE]
>
> You must configure your target SSH servers to trust the CA before certificate-based authentication will work. This only needs to be done once per host.

**6. Configure target hosts**

**Option A — Automated setup**

Run the provided command on each target host:

```bash theme={"dark"}
curl -H "Authorization: Bearer <your-token>" "https://<your-infisical-url>/api/v1/dynamic-secrets/ssh-ca-setup/<dynamic-secret-id>" | sudo bash
```

This script will:

* Write the CA public key to `/etc/ssh/infisical_ca.pub`
* Add `TrustedUserCAKeys /etc/ssh/infisical_ca.pub` to `/etc/ssh/sshd_config`
* Validate the SSH configuration and restart the SSH service

**Option B — Manual setup**

1. Copy the CA public key (available via the eye icon in the setup modal or the edit form)
2. Save it to `/etc/ssh/infisical_ca.pub` on the target host
3. Add the following line to `/etc/ssh/sshd_config`:
   ```
   TrustedUserCAKeys /etc/ssh/infisical_ca.pub
   ```
4. Restart the SSH service

You can also retrieve the CA public key programmatically:

```bash theme={"dark"}
curl -H "Authorization: Bearer <your-token>" "https://<your-infisical-url>/api/v1/dynamic-secrets/ssh-ca-public-key/<dynamic-secret-id>"
```

This returns a JSON response: `{ "caPublicKey": "ssh-ed25519 AAAA..." }`

**7. Generate dynamic secrets**

Once you've configured the dynamic secret and set up target hosts, you're ready to generate on-demand credentials.
To do this, simply select the **Generate** button which appears when hovering over the dynamic secret item.

![Hover Generate Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/hover-generate-lease.png)

When generating a lease, you will need to provide:

**TTL** `string` *required*

How long the certificate should be valid for. Must be within the Max TTL configured on the dynamic secret.

**Principals** `list` *required*

One or more usernames (from the allowed principals) that the certificate should be valid for.

![Generate Lease Form](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/generate-lease-form.png)

Once you click **Submit**, a new lease will be generated containing:

* **Private Key** — the ephemeral SSH private key (downloadable as `key.pem`)
* **Signed Certificate** — the SSH certificate signed by the CA (downloadable as `cert.pub`)

Both can be downloaded or copied directly from the UI.

![Lease Output](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/lease-credentials.png)

> [!WARNING]
>
> Copy or download these credentials immediately. You will not be able to see them again after closing the modal.

**8. Use the certificate to connect**

After downloading `key.pem` (private key) and `cert.pub` (signed certificate), set the correct permissions and connect:

```bash theme={"dark"}
# Set private key permissions
chmod 600 key.pem

# Connect to the target host
ssh -i key.pem -o CertificateFile=cert.pub <principal>@<hostname>
```

Replace `<principal>` with one of the principals included in the certificate and `<hostname>` with the target host address.

## Generate via CLI

You can also create SSH dynamic secret leases using the CLI:

```bash theme={"dark"}
infisical secrets-manager dynamic-secrets lease create <secret-name> \
  --projectId=<project-id> \
  --env=dev \
  --principals=root,deploy
```

The `--principals` flag is required for SSH dynamic secrets and accepts a comma-separated list. The requested principals must be a subset of the allowed principals configured on the dynamic secret.

For more details, see the [CLI dynamic secrets documentation](https://infisical.com/docs/cli/reference.md#secrets-manager-dynamic-secrets).

## Audit or revoke leases

Once you have created one or more leases, you'll be able to access them by selecting the respective dynamic secret item on the dashboard.

![Hover View Leases](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/hover-view-leases.png)

This will allow you to see the expiration time of the lease or delete the lease before its set time to live.

![View Leases Expiry](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/lease-expiry.png)

> [!NOTE]
>
> SSH certificates are time-bound and expire automatically. Revoking a lease in
> Infisical removes the record, but the certificate remains valid until its TTL
> expires.

## Edit dynamic secret

To update the configuration of an existing SSH dynamic secret (principals, key algorithm, CA key algorithm, TTL, or to access the CA setup options), select the dynamic secret item and then **Edit**.

![Edit Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/ssh/edit-dynamic-secret.png)

## Renew leases

> [!NOTE]
>
> SSH certificate leases can't be renewed because the certificate validity is
> baked in at signing time. To get a new certificate, create a new lease.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.