How does GitHub handle SSH key management for GHES instances where users must use corporate SSH keys only?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GHES gives admins control over acceptable SSH key types. You can disable old weak key types like RSA-1024 or DSA and only allow modern Ed25519 or RSA-4096 keys. Users still add their own keys, but only the approved types are accepted.
Full explanation below image
Full Explanation
GitHub Enterprise Server provides administrators with controls over SSH key types accepted by the instance. In the Management Console, site administrators can: (1) Enable or disable specific SSH key types (RSA, DSA, ECDSA, Ed25519). (2) Set minimum key length requirements for RSA keys. (3) Deprecate weak key types that present security risks. Individual users still upload their own SSH public keys through their account settings — GHES does not automatically provision or push keys from LDAP (though LDAP can be used for authentication, SSH key management remains separate). This key type control allows organizations to enforce cryptographic hygiene standards without a third-party tool. Users uploading keys of unapproved types receive an error.