Make a credential that expires before it can be reused

short · 40 min · Objective 4.6

Task

Issue a short-lived credential, use it, then try to use it again after it has expired. Ephemeral credentials remove the thing an attacker steals, and the difference from a long-lived secret is easiest to see by watching one stop working.

Steps

  1. Set up SSH certificate authentication between your two lab VMs: generate a CA key, configure the target to trust it, and remove password authentication.
  2. Issue a long-lived certificate for a user and confirm it works. Note that this file, if stolen, works until it expires.
  3. Now issue a SHORT-lived certificate — validity of two minutes — with ssh-keygen -s ca_key -I lab -n labuser -V +2m user_key.pub.
  4. Use it immediately and confirm access works.
  5. Wait for it to expire, then try again with the same certificate file and confirm access is refused. Capture the exact error.
  6. Write /tmp/ephemeral.md comparing what an attacker gains from stealing each of the two certificate files, and note what infrastructure short-lived credentials require in exchange.

Verify

ssh-keygen -L -f /tmp/short_key-cert.pub | grep -E "Valid:"
ssh -i /tmp/short_key labuser@10.99.0.20 true 2>&1 | grep -ci "expired\|denied"
python3 - <<'PY'
import subprocess,datetime,re
out=subprocess.run(['ssh-keygen','-L','-f','/tmp/short_key-cert.pub'],
                   capture_output=True,text=True).stdout
m=re.search(r'Valid:.*?to (\S+ \S+)', out)
print('certificate validity line:', m.group(0) if m else 'not found')
assert m, 'the certificate has no expiry - it was issued without -V'
end=datetime.datetime.strptime(m.group(1),'%Y-%m-%dT%H:%M:%S')
print('expired:', end < datetime.datetime.now())
PY
grep -ciE "steal|window|infrastructure" /tmp/ephemeral.md

The assertion requires the certificate to carry a real expiry, which is what -V adds and what an unbounded certificate lacks. The second command must show the refusal after expiry. The comparison you wrote is the lesson: a stolen long-lived credential is access, and a stolen two-minute one is nothing.

Notes

What it costs is the other half. Short-lived credentials need something to issue them continuously — a CA, an agent, an identity provider — and that issuer becomes critical infrastructure. This is the trade behind just-in-time access: you remove the standing credential and acquire a standing dependency.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.