How to Phase Out Shared SSH Keys for Team Access
Shared SSH keys usually survive because they are convenient. Everyone knows where the PEM is, every old script works, and nobody wants to break emergency access.
That convenience is also the problem. You cannot revoke one person, prove who connected, or know whether a vendor kept a copy.
Shared key replacement flow
Risk reduction by replacement step
You know the mess, but it still exists.
Access narrows to teams and hosts.
Old credentials stop hanging around.
Revocation and audit become real.
Start with the keys that scare you
Do not boil the whole fleet. Start with root keys, contractor keys, keys used across many hosts, and PEM files copied into deployment folders.
Create a host-to-key map before making changes. You need to know what will break.
Give engineers a better workflow
Security controls fail when they make normal work painful. The replacement must be fast enough for on-call: request access, pass 2FA, open a scoped shell, and expire afterwards.
CertLocker supports short-lived SSH workflows and browser-based access so the team can stop passing PEM files around.
Keep break-glass, but make it visible
Emergency access is fine. Invisible emergency access is not. Keep a break-glass route with a small audience, clear expiry, and review.
The goal is not theatre. It is knowing who could reach production and why.
SSH key migration checklist
- ✓ Find shared PEMs in repositories, deployment hosts, laptops, CI variables, and vendor folders.
- ✓ Map each key to hosts, users, scripts, and support workflows.
- ✓ Create group-based access for normal work.
- ✓ Test short-lived SSH access before disabling shared keys.
- ✓ Review logs after cutover for old-key attempts.
Related reading and workflows
SSH access management
Short-lived SSH access, browser sessions, 2FA, groups, and audit.
Zero-trust SSH use case
A practical model for replacing long-lived PEM files.
Short-lived SSH access with 2FA
How CertLocker handles scoped server access and audit trails.
Help with onboarding
Bring your existing inventory to a hosted walkthrough with the CertLocker engineers.
CertLocker for DevOps teams
The broader trust-control workflow for platform and infrastructure teams.
Compare CertLocker with scripts
Where spreadsheets, cron jobs, and shared files stop being enough.
Try the workflow against real infrastructure
Use the hosted evaluation at trust.certlocker.io for a walkthrough, or run a one-month onsite evaluation against your own certificates, hosts, secrets, and access paths.