As an alternative to ssh certs, we lookup keys in an LDAP Cluster. Each approach has pros/cons. SSH certificates are decentralized and resilient against failure, but revocation of a breached certificate isn't instantaneous. Keys-in-LDAP offers less resiliency, but offers instant key revocation. It's also simpler and offers a familiar experience to most devs.
The most important thing is to look at your attack surface realistically and plan accordingly. Just blinding putting in an SSH cert authority of an unsecured-non-redundant ldap cluster is worse than no key management at all.
The most important thing is to look at your attack surface realistically and plan accordingly. Just blinding putting in an SSH cert authority of an unsecured-non-redundant ldap cluster is worse than no key management at all.