What advantage do SSH certificate authorities configured for a GitHub Enterprise offer compared with unmanaged long-lived user SSH keys alone?
Select an answer to reveal the explanation.
Short Explanation and Infographic
SSH CAs let you mint short-lived, centrally trusted certs instead of forever personal keys. Expiry doesn't open repos, and HTTPS/PATs don't vanish by magic.
Full explanation below image
Full Explanation
GitHub Enterprise can trust SSH certificate authorities so user or host authentication uses certificates signed by the enterprise CA. Certificates are commonly short-lived, which shrinks the blast radius of a stolen credential and allows revocation or non-renewal at the CA. SSH CAs do not rewrite remotes to insecure git:// URLs, do not legally disable PATs or HTTPS, and certificate expiry does not flip repository visibility to public. Admins should integrate CA issuance with device trust and identity onboarding, monitor for residual classic keys, and document emergency revocation. This control is especially valuable in regulated environments with strict credential lifetime policies.