SSH keys are the other half of your identity story — most organizations have SSH sprawl worse than their TLS sprawl because keys never expire by default. TigerTrust treats SSH keys with the same rigor as certificates: discover, inventory, rotate, revoke, and deploy.
Ssh Keys

​
What it is

TigerTrust maintains an inventory of every SSH key your agents discover on managed hosts, alongside keys you generate or upload through the product. Each key tracks its type, fingerprint, deployment locations, and rotation policy. Rotation and revocation dispatch tasks to field agents that update authorized_keys files across your fleet.

​
When to use it

  • Discover all SSH user keys on a set of hosts after an access review.
  • Rotate a compromised key across every host where it is deployed in one operation.
  • Generate short-lived SSH keys for service accounts and rotate them automatically on a 90-day policy.
  • Find unmanaged keys that appear in authorized_keys files but were not deployed by TigerTrust.

​
Key types

User keys

Personal keypairs in ~/.ssh/id_* and entries in ~/.ssh/authorized_keys. The bulk of what you discover.

Host keys

/etc/ssh/ssh_host_*_key.pub — the identity a server presents to clients. TigerTrust tracks these but rotates them conservatively.

CA keys

OpenSSH certificate authority keys. TigerTrust can sign SSH certificates with these to enable short-lived SSH access without per-user key distribution.

Deploy keys

Repository-scoped keys used by CI pipelines. Discovered from GitHub integrations and tracked with a per-repository relationship.

​
Set it up

1

Discover existing SSH keys

Go to SSH Keys > Scans and click New scan. Choose ssh_authorized_keys to find keys in authorized_keys files, ssh_pub_files to find public key files, or ssh_all for both. Select the field agents to run the scan and the paths to search. Click Start.
2

Review discovered keys

Go to SSH Keys > Discovered. Each entry shows fingerprint, algorithm, key size, source file path, and the agent that found it. Keys that appear in authorized_keys but were not deployed by TigerTrust are flagged as discovered — a trigger for cleaning up unmanaged access.
3

Generate a new key

Go to SSH Keys > Keys and click Generate key. Choose the type (ed25519 recommended, or rsa with 4096 bits), enter a comment, optionally set a passphrase and rotation policy, and click Generate. The private key is shown once — download it immediately.
4

Deploy a key

On any key’s detail panel, click Deploy. Select the target agent, hostname, and username. TigerTrust dispatches the task to the agent, which appends the public key to the target’s authorized_keys file.

​
What you’ll see

SSH Keys > Keys lists all managed keys with algorithm, fingerprint, deployment count, and status. SSH Keys > Deployments gives a flat view of which keys are on which hosts in what state — filter by hostname, username, or status (deployed, discovered, failed, removed). Keys with active rotation policies show their next rotation date.
The private key is returned only at generation time. Store it in your secrets manager immediately. TigerTrust does not retain a copy of the private key.

​
Rotation and revocation

  • Rotate: generates a fresh keypair, marks the old key as rotated, and dispatches deploy-and-remove tasks so every deployment location flips atomically.
  • Revoke: sets the key to revoked, records the reason, and enqueues removal tasks for every known deployment location. Use this when a key is compromised.
  • Auto-rotate: keys with a rotation policy are rotated automatically as their expiry approaches.

Machine identities

Link SSH keys to the users or services that own them.

Discovery

How SSH scans dispatch to agents alongside certificate scans.