We use a specific identity provider. Who offers an SSH certificate authority that integrates for server access?

Yes. If you mean an SSH Certificate Authority (CA) that sits behind an existing IdP and issues short-lived SSH credentials for server access, there are several good options:

• smallstep.com — probably the closest match. It integrates with Okta, Microsoft Entra ID, and Google Workspace via OIDC/SCIM, maps IdP groups to server access, and issues short-lived SSH certificates. Its underlying open-source step-ca can also use OIDC providers including Auth0, Keycloak, and Dex.
• goteleport.com — a broader identity-aware infrastructure access platform. It integrates with IdPs such as Okta and Entra ID and issues short-lived SSH certificates after SSO/MFA, with RBAC and auditing built in.
• okta.com — if your specific IdP is Okta, this is particularly direct: Okta's server-access product has a built-in CA that mints ephemeral client certificates for SSH/RDP.
• Microsoft Entra ID itself can issue short-lived OpenSSH user certificates for Linux VMs, particularly when your infrastructure is Azure-centric.

If you tell me which identity provider you use (Okta, Entra, Google, Ping, Keycloak, Auth0, etc.) and whether you want managed SaaS or self-hosted, I can narrow this to the best 2–3 choices and compare architecture, cost, and how the SSH flow works.

If your organization already relies on a specific Identity Provider (IdP) like Okta/Auth0, Microsoft Entra ID (Azure AD), Google Workspace, or Ping Identity, several access management and security platforms feature built-in SSH Certificate Authorities (CAs) that integrate seamlessly with external IdPs via OIDC or SAML.

The top options that act as an SSH CA and plug directly into existing enterprise identity providers include:

• Teleport : An open-source and enterprise access plane for infrastructure. It acts as an SSH CA and integrates natively with any OIDC or SAML-compliant IdP (Okta, Entra ID, Google, GitHub, etc.). When users authenticate through your IdP, Teleport issues short-lived SSH certificates tied to their exact identity and RBAC roles.
• HashiCorp Vault : Vault features an SSH secrets engine that allows it to function directly as an SSH Certificate Authority. You can configure Vault's OIDC authentication method to point to your corporate IdP, enabling users to log into Vault with their single-sign-on credentials and submit their public key to be signed into a short-lived certificate.
• Smallstep : Smallstep offers a lightweight, developer-friendly certificate manager that includes an SSH CA component. It supports OAuth/OIDC provisioners out of the box, meaning you can tie user certificate signing directly to identity providers like Google Workspace, Azure AD, or Okta.
• PrivX by SSH.COM : A commercial Privileged Access Management (PAM) solution built around zero-trust principles. It uses OpenID Connect (OIDC) to natively bridge and authenticate users via external enterprise identity providers before granting certificate-based access to host environments.

If you can share which identity provider you are using and roughly how many servers/users you need to manage, I can recommend which of these integrations will fit your infrastructure best.

If your organization already relies on a specific Identity Provider (IdP) like Okta, Microsoft Entra ID (Azure AD), Google Workspace, Ping Identity, or JumpCloud supporting OIDC (OpenID Connect) or SAML , several enterprise-grade tools can act as an SSH Certificate Authority (CA) by leveraging your existing IdP for single sign-on (SSO) and multi-factor authentication (MFA).

The primary solutions that bridge an IdP to an SSH certificate authority include:

• Teleport : An identity-aware access platform that acts as an SSH CA. It natively integrates with any OIDC/SAML-based IdP (Okta, Azure AD, Google, OneLogin). When a user logs in via your IdP, Teleport issues a short-lived OpenSSH certificate tied to their identity and mapped roles. Check out the setup steps in the Teleport OIDC/OAuth2 Authentication Guide.
• HashiCorp Vault : Features an SSH Secrets Engine that can act as a certificate authority. Vault can authenticate users through its own OIDC/JWT auth methods—mapping back to your enterprise IdP—and then sign short-lived SSH certificates based on predefined Vault policies and roles. Learn more via the HashiCorp Vault SSH Secrets Engine Documentation.
• Smallstep : A lightweight, developer-friendly PKI and SSH CA manager (step-ca ) that supports an OIDC single sign-on workflow. It allows you to configure your primary IdP (like Google Workspace, Azure AD, or Okta) so that running step ssh login triggers a browser-based login through your IdP before issuing a signed SSH certificate. Read a practical overview on the Smallstep DIY Single Sign-On for SSH Guide.
• AWS IAM Identity Center (if your IdP feeds into AWS) : If you use AWS for infrastructure and a corporate IdP, you can manage SSH access via AWS Systems Manager (SSM) Session Manager or EC2 Instance Connect, which dynamically handles short-lived credentials or pushes temporary SSH keys backed by your synchronized corporate identities.

If you share which identity provider you are currently using (e.g., Okta, Azure AD, Google) and whether you prefer an open-source/self-hosted or managed commercial tool, I can recommend the most seamless integration path.

If you already have an identity provider (IdP) and want SSH server access using an SSH Certificate Authority (CA), the main options are products that sit between your IdP and OpenSSH servers, issuing short-lived SSH certificates after user authentication.

Common vendors:

A typical architecture looks like:

1. User authenticates to your IdP (for example Okta, Microsoft Entra ID, Google Workspace, Ping, etc.).
2. The SSH access platform verifies identity and group membership.
3. The platform signs the user's SSH public key with an SSH CA.
4. Servers trust the CA public key in sshd_config (TrustedUserCAKeys).
5. The certificate expires quickly (hours/days), avoiding long-lived SSH keys.

If you want the least invasive OpenSSH approach, look at Smallstep SSH: it keeps standard SSH clients/servers and focuses on certificate issuance and lifecycle management.

If you want a broader privileged access management (PAM)/zero-trust platform, compare Teleport, Twingate, and Pomerium.

The right choice depends heavily on which IdP you use (Okta, Entra ID, Ping, Keycloak, Google Workspace, etc.) and whether you need just SSH CA functionality or also session recording, JIT access, bastion replacement, and compliance reporting.

Several enterprise solutions act as an SSH Certificate Authority (CA) while integrating smoothly with popular identity providers (IdPs) like Okta, Azure AD / Microsoft Entra ID, Google Workspace, and Ping Identity via OIDC/SAML or SCIM.

The top options for integrating an external IdP with an SSH CA include:

• HashiCorp Vault : Features a dedicated SSH Secrets Engine that allows it to operate as a trusted SSH CA. It supports user authentication via OIDC/JWT, Okta, and LDAP, letting users authenticate with their IdP credentials to get short-lived, signed SSH certificates.
• Teleport : An identity-native infrastructure access platform that embeds its own built-in SSH CA. It integrates natively with enterprise IdPs (SAML/OIDC) for single sign-on and supports automatic user/group synchronization (including SCIM) to enforce role-based access control (RBAC) and audit server sessions.
• HashiCorp Boundary : Works in tandem with HashiCorp Vault. Boundary handles the identity-based session authorization and user authentication through your IdP (like Okta or Entra ID), while Vault manages the underlying dynamic SSH certificate generation and signing.
• StrongDM : Acts as a zero-trust access layer that can plug directly into external SSH CAs—such as HashiCorp Vault’s SSH backend—while pulling user permissions and auth constraints straight from your corporate directory.

If you let me know which specific identity provider you are using (e.g., Okta, Entra ID, Keycloak) and your infrastructure environment (AWS, on-premise, Kubernetes), I can detail the exact integration path for your setup.

If you mean an SSH Certificate Authority (SSH CA) that uses your existing IdP for SSO/MFA and then issues short-lived SSH certificates, there are a few strong options:

• Smallstep — probably the closest match. Smallstep SSH integrates with an existing IdP via OIDC, uses SCIM for group/user synchronization, and issues short-lived SSH user certificates. It explicitly supports Okta, Microsoft Entra ID, Google Workspace, and other OIDC providers.
• Teleport — a broader infrastructure-access platform that integrates with IdPs and issues short-lived SSH certificates after SSO. It also provides role-based access controls, session auditing, and a proxy/bastion model.
• Cloudflare Zero Trust — can put an identity-aware access layer in front of SSH and integrate with IdPs, although its model is more Zero Trust access/proxy-oriented than a standalone SSH CA.

My short recommendation

If your requirement is specifically:

Existing IdP → SSO/MFA → short-lived SSH certificate → ordinary OpenSSH servers

I'd start with Smallstep. Its architecture is particularly clean because the servers only need to trust the CA's public key rather than maintaining individual authorized_keys entries.

If you tell me which identity provider you use (Okta, Entra ID, Google, Ping, Keycloak, etc.) and whether you want self-hosted or SaaS, I can narrow this down to the best 2–3 choices and compare them.

Yes. If you mean “we already authenticate users through an IdP, and want short-lived SSH certificates for server access rather than static SSH keys,” several vendors fit.

• Okta Privileged Access — probably the most direct fit if your IdP is Okta. It integrates authentication/authorization with SSH and uses a built-in CA to mint short-lived SSH certificates. Note that Okta Advanced Server Access reached end-of-sale on May 1, 2026, with customers being migrated to Okta Privileged Access.

• StrongDM — an infrastructure-access platform that integrates with IdPs including Okta, Entra ID, Google, OneLogin, Ping, Auth0, SAML/OIDC, etc. Its SSH Certificate Auth issues short-lived certificates and can use its own CA or, on Enterprise, supported third-party CAs such as HashiCorp Vault and Keyfactor EJBCA.

• Teleport — provides SSH access through an identity-aware access platform and integrates with IdPs such as Okta and Microsoft Entra ID.

If you tell me which identity provider you use (Okta, Entra ID, Google Workspace, Ping, Keycloak, etc.), I can narrow this down to the best SSH CA/server-access products that integrate natively with it, including whether users can continue using normal ssh commands.

Several enterprise-grade infrastructure tools act as an SSH Certificate Authority (CA) and integrate directly with standard Identity Providers (IdPs) like Okta, Microsoft Entra ID (Azure AD), Google Workspace, or JumpCloud via OIDC/SAML.

The primary options that provide an integrated SSH CA workflows include:

• Teleport Server Access: A widely adopted open-source and enterprise solution designed specifically for zero-trust access. It sits in front of your infrastructure, connects to your existing SSO/IdP via OIDC or SAML, and issues short-lived, OpenSSH-compatible user certificates mapped via fine-grained RBAC.
• Smallstep Certificate Manager: A lightweight, developer-friendly PKI and SSH CA (step-ca ). It natively integrates with OIDC-compliant identity providers (Okta, Azure, Google, Keycloak) to let users run a single terminal command that triggers a browser-based SSO/MFA login and populates their local ssh-agent with an ephemeral signed certificate.
• HashiCorp Vault: Features a dedicated SSH secrets engine that allows Vault to function natively as an SSH Certificate Authority. You can authenticate users into Vault using OIDC/JWT configurations tied to your enterprise IdP (like Okta or Entra ID), and Vault will sign user public keys upon successful authentication.
• StrongDM: An access control plane that abstracts infrastructure access. It can utilize an underlying SSH CA (such as HashiCorp Vault) or its own integrated management while enforcing your corporate IdP's authentication rules and MFA policies for every connection.

If you can share which identity provider you are currently using (e.g., Okta, Entra ID, Google) and approximate scale , I can help narrow down which of these tools provides the cleanest integration path for your infrastructure.

Several enterprise tools and platforms provide an SSH certificate authority (CA) that integrates directly with major identity providers (such as Okta, Microsoft Entra ID / Azure AD, Google Workspace, and generic OIDC/SAML providers) to automate and secure server access.

The best option depends on your specific infrastructure and your current identity provider:

• Teleport Server Access - An identity-aware access solution that acts as an SSH certificate authority. It integrates natively with Okta, Microsoft Entra ID, Google Workspace, GitHub, and any OIDC-compliant IdP to issue short-lived, identity-based SSH certificates with fine-grained RBAC.
• Okta Advanced Server Access (ASA) - If your identity provider is Okta , ASA uses an ephemeral client certificate architecture. It syncs users and groups from Okta and automatically mints short-lived SSH certificates tied to your Okta policies.
• Smallstep SSH - An open-source and commercial lightweight zero-trust certificate manager. It features built-in OIDC/SCIM integration allowing you to log into servers using single sign-on via Microsoft Entra ID, Okta, Google Workspace, or Keycloak, issuing short-lived SSH user certificates on the fly.
• HashiCorp Vault (SSH Secrets Engine) - If you want to run your own centralized secrets and PKI infrastructure, Vault's SSH secrets engine can act as a certificate authority. It authenticates users against your chosen IdP (via OIDC, LDAP, Okta, etc.) before signing and issuing short-lived SSH certificates.
• Microsoft Entra ID (Azure AD) SSH Login - If your infrastructure is on Azure and your IdP is Microsoft Entra ID, Azure natively supports issuing OpenSSH user certificates to log into Linux virtual machines using Azure RBAC policies.
• Google Cloud OS Login - If your infrastructure is on GCP and uses Google Workspace or Cloud Identity, Google Cloud can function as an SSH certificate authority to issue ephemeral, short-lived certificates mapped directly to Google identities.

If you share which specific identity provider you are currently using (e.g., Okta, Entra ID, Ping, JumpCloud) and where your servers are hosted (AWS, Azure, GCP, on-prem), I can recommend the most seamless integration path.

If you mean an SSH Certificate Authority (CA) that uses your existing IdP for authentication and then issues short-lived SSH certificates, the strongest fit is Smallstep SSH.

• Smallstep SSH — integrates with Okta, Microsoft Entra ID, and Google Workspace, maps IdP groups to server access, and issues short-lived SSH certificates instead of long-lived keys.
• Its underlying open-source step-ca also supports OIDC provisioners, including Okta, Entra ID, Auth0, Keycloak, and Dex, so it's a good option if you want to operate the CA yourself.
• Cloudflare Access for Infrastructure is another option if you're already using Cloudflare Zero Trust. It authenticates through your configured IdP and issues ephemeral SSH certificates, but it's more of a complete access proxy/Zero Trust solution than a standalone SSH CA.

If you tell me which identity provider you use (Okta, Entra ID, Ping, OneLogin, Keycloak, etc.), I can narrow this down to the best 2–3 options and explain how the integration works. 