> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SSH certificate authentication

> Let people connect to SSH servers with short-lived certificates instead of stored credentials.

With certificate authentication, an [SSH account](https://infisical.com/docs/documentation/platform/pam/accounts/ssh) stores no password or private key. Each account has its own certificate authority (CA), and when someone launches a [session](https://infisical.com/docs/documentation/platform/pam/sessions/overview), Infisical signs a certificate that's valid only for that session. The server accepts the certificate because it trusts the account's CA.

This guide creates an SSH account that uses certificate authentication, then configures the server to trust the account's CA.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* Root access on the server
* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the server on its SSH port

## Step 1: Create the SSH account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** and an SSH **Account Template**, then select **Next**.

**Step 3**

Enter a **Name**, and the server's **Host** and **Port**. If the template doesn't set a Gateway, select one under **Gateway**.

**Step 4**

Select **Certificate** as the **Auth Method**, enter the **Username** to log in as, and select **Create**.

## Step 2: Configure the server to trust the account's CA

**Step 1**

On the **Accounts** page, open the options menu of the account you created and select **Configure**. Under **SSH CA setup required**, select **Copy install command**.

**Step 2**

Run the command on the server. The command downloads a setup script and runs it as root.

The script adds the account's CA public key to the file that the `TrustedUserCAKeys` setting in `sshd_config` points to. If `sshd_config` has no `TrustedUserCAKeys` setting, the script adds the key to `/etc/ssh/infisical_ca.pub` and adds the setting. It then checks the configuration with `sshd -t` and restarts the SSH service.

**Step 3**

Check that the server trusts the CA file:

```bash theme={"dark"}
sudo sshd -T | grep -i trustedusercakeys
```

> [!NOTE]
>
> The command contains your Infisical access token, which it uses to download the script. To read the script before you run it, run the command without `| sudo bash`.

## Step 3: Connect to the server

Anyone with access to the account can now launch a session on it from the **Accounts** page, in the browser or through the CLI. To learn how, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md).

If a session fails to authenticate, check that the account's **Username** exists on the server and that the setup script finished without errors.

## Next steps

> [card] [Access control](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md)
>
> Control who can manage PAM and who can connect to each account.

> [card] [Sessions](https://infisical.com/docs/documentation/platform/pam/sessions/overview)
>
> Review and end the connections that people and agents make to your accounts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.