Anyone who manages a server, a cloud instance, or even a Raspberry Pi on their home network eventually runs into the same question: how should people actually log in? The default answer for decades was a username and password. Today, most security-conscious administrators have moved away from that model, but the alternatives, key pairs and certificates, aren’t always well understood. Each method has a different security posture, different failure modes, and different operational overhead. Understanding those differences matters more than most people realize, especially as brute-force login attempts against exposed servers have become a constant, automated background noise on the internet.
This article breaks down how passwords, SSH keys, and SSH certificates actually work, where each one falls short, and how to set up SSH keys correctly if you’re moving away from password-based access.
Why Passwords Keep Failing as an Authentication Method
Passwords are the oldest and most familiar way to prove identity, but they carry structural weaknesses that no amount of user education fully solves. A password is a shared secret, something typed into a login prompt and compared against a stored value. That comparison model creates several problems at once.
First, passwords are guessable. Automated bots scan the internet constantly, and any server with SSH open on port 22 will typically see thousands of login attempts per day using common username-password combinations. Research from network security monitoring groups has repeatedly shown that credential-stuffing and brute-force attacks account for a large share of unauthorized access attempts on internet-facing systems.
Second, passwords are reusable and often reused. People manage dozens of accounts, and password fatigue leads many to reuse the same credentials across services. If one service is breached, attackers often try those same credentials elsewhere, a technique known as credential stuffing.
Third, passwords depend entirely on human behavior for their strength. A system can enforce complexity rules, but it can’t force someone to avoid writing a password on a sticky note or reusing it from a personal account.
None of this means passwords are useless everywhere. But for remote server access specifically, where a single compromised login can expose an entire system, the security community has largely converged on public-key authentication as the more resilient default.
How SSH Keys Actually Work
SSH key authentication replaces the shared-secret model with public-key cryptography. Instead of typing a password, the user holds a private key, and the server holds a matching public key. During login, the server issues a cryptographic challenge that only the corresponding private key can answer correctly. The private key itself never leaves the user’s machine, which removes an entire category of risk, there’s nothing to intercept, guess, or brute-force in the same way a password can be attacked.
This is precisely why so many guides on how to set up SSH keys emphasize protecting the private key file above almost everything else. If that file is copied or exposed, the protection the key pair offers is effectively gone. Most setups also encrypt the private key with a passphrase, adding a second layer in case the file itself is ever copied without authorization.
For anyone learning how to set up SSH keys for the first time, the general process looks like this:
- Generate a key pair using a tool like ssh-keygen, ideally with a modern algorithm such as Ed25519 rather than older RSA keys with short lengths.
- Store the private key securely on the local machine, protected by a passphrase.
- Copy the public key to the server’s authorized_keys file, often using a helper command like ssh-copy-id.
- Disable password-based login on the server once key-based access is confirmed to work, closing off the weaker authentication path entirely.
- Rotate or revoke keys periodically, especially after staff changes or suspected exposure.
Knowing how to set up SSH keys is now considered a baseline skill for anyone administering Linux or Unix-based systems, not an advanced technique reserved for large organizations.
Where SSH Keys Still Fall Short
SSH keys solve the guessability problem, but they introduce a different challenge: management at scale. A single administrator with one laptop and one server can manage keys easily. An organization with hundreds of engineers, dozens of servers, and constant staff turnover faces a much harder problem — tracking which keys exist, where they’re authorized, and whether they’ve been properly revoked when someone leaves.
This is where orphaned keys become a real risk. A key added to a server’s authorized_keys file doesn’t expire on its own. If it isn’t manually removed, it can remain valid indefinitely, long after the person who created it has moved on. Studies of enterprise SSH environments have found that unmanaged key sprawl is a common and underappreciated source of unauthorized access risk, particularly in organizations without centralized key inventory tools.
SSH Certificates: Solving the Trust Management Problem
SSH certificates address the scaling issue directly. Rather than distributing and manually authorizing individual public keys on every server, an organization runs a certificate authority (CA) that signs short-lived certificates for users and hosts. Servers are configured to trust the CA itself, not each individual key. When a certificate expires — often after a few hours or days — access is automatically revoked without anyone needing to touch a server’s configuration.
This model mirrors how TLS certificates work for websites, and it solves the two weakest points of raw key-based access: manual provisioning and indefinite validity. Instead of asking “is this specific key still authorized,” the system asks “is this certificate still valid and signed by a trusted authority,” which is far easier to audit and automate.
The tradeoff is complexity. Running a certificate authority requires infrastructure, careful key protection for the CA’s own signing key, and a level of operational maturity that smaller teams may not need. For an individual developer or a small team managing a handful of servers, standard SSH keys are often sufficient. For larger organizations with dynamic infrastructure and frequent personnel changes, certificates offer meaningfully better control.
What We’ve Learned
Passwords remain the weakest option for remote server access because they rely on secrecy that’s hard to maintain and easy to attack at scale. SSH keys are a significant improvement, removing guessable secrets from the equation entirely, which is why learning how to set up SSH keys has become standard practice for developers and system administrators alike. Certificates go a step further, solving the operational headaches of key management for larger, more dynamic environments.
There’s no single “most secure” answer that fits every situation — the right choice depends on the size of the environment, how often access needs change, and how much operational overhead a team can reasonably maintain. What’s clear is that moving away from static passwords, in favor of cryptographic authentication of some form, is no longer optional advice. It’s the baseline expectation for anyone responsible for keeping a server reachable only by the people who should actually have access to it.
Ask Sharone Phillipssond how they got into emerging technology overview and you'll probably get a longer answer than you expected. The short version: Sharone started doing it, got genuinely hooked, and at some point realized they had accumulated enough hard-won knowledge that it would be a waste not to share it. So they started writing.
What makes Sharone worth reading is that they skips the obvious stuff. Nobody needs another surface-level take on Emerging Technology Overview, Gadget Reviews, Software Development Insights. What readers actually want is the nuance — the part that only becomes clear after you've made a few mistakes and figured out why. That's the territory Sharone operates in. The writing is direct, occasionally blunt, and always built around what's actually true rather than what sounds good in an article. They has little patience for filler, which means they's pieces tend to be denser with real information than the average post on the same subject.
Sharone doesn't write to impress anyone. They writes because they has things to say that they genuinely thinks people should hear. That motivation — basic as it sounds — produces something noticeably different from content written for clicks or word count. Readers pick up on it. The comments on Sharone's work tend to reflect that.
