An SSH certificate is a signed wrapper around a public key. The private key stays on the client; the CA signs the corresponding public key and adds certificate metadata, including principals and validity times.
User certificates
When nk requests a user certificate, the core signs the local public key with an SSH CA. The certificate principal is the Nokku user UUID. The requested Linux username is checked separately by the target server.
This separates identity from the Unix account. Two users can both be authorized for root without sharing the same Nokku identity.
Host certificates
nokkud generates the server’s SSH host key and requests signed host certificates from the core, storing them under /var/lib/nokkud/ and hot-reloading them into its embedded SSH server without a restart. nk receives the CA trust information in its synchronized target data and writes corresponding known-host entries.
Host certificates identify the server to the client. User certificates identify the connecting user to the server.
Static keys and certificates
With static keys, each server needs a copy of each user’s public key. With certificates, servers trust a CA public key and check the certificate principal against their authorization policy.
Certificates reduce key distribution work and add explicit identity and expiry. They do not remove the need to configure trust, assign access, protect private keys, or plan revocation windows.
Manual mode
Manual targets use TrustedUserCAKeys and AuthorizedPrincipalsFile on the system sshd. Daemon-managed targets use nokkud’s embedded SSH server, which verifies the CA signature and checks the certificate principal against its synchronized principal cache in-process.