Quickstart guide to the SSH CA

Secure Shell (SSH) certificates offer a simple and secure alternative to traditional SSH keys. SSH certificates are requested from a Certificate Authority (CA) and then used to access a resource.

Configuration

Before starting to use the SSH CA, you need to set up an SSH key pair and configure your system to trust the SSH CA.

Generate a new personal SSH key pair.
```
ssh-keygen -t ed25519 -f ~/.ssh/id_EFP
```
This creates the two files, the private and public keys respectively.
```
~/.ssh/id_EFP  
~/.ssh/id_EFP.pub
```

Trust the CA SSH's public key.

echo 'sshca.my-eurohpc.eu ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlPFxv2xhvg2Jlyt7TE8cTuVbk27LpFJmILWpXm/7xz' >> ~/.ssh/known_hosts

You only need to perform these steps once on each of your systems.

Connect to a resource

To connect to a resource, you use your SSH key pair to request a certificate.

Using your browser, login to https://sshca.my-eurohpc.eu.
After logging in, the portal will list the resources that you can access. This includes the ssh command-line needed to request a certificate for the resource. Copy the command-line for the intended resource and paste it into your terminal window to execute the command.

(The following is an example - you should copy and paste the command-line shown in your browser).
```
ssh -i ~/.ssh/id_EFP -o IdentitiesOnly=yes -p 2226 sshca.my-eurohpc.eu token OICCDNIG5BBCM5MOAHM4HXXE36-A > ~/.ssh/id_login.deucalion.macc.fccn.pt-cert.pub
```
Return to your browser.
Copy the ssh command-line displayed into your system clipboard and paste it into your terminal window.

(The following is an example - you should copy and paste the command-line shown in your browser).
```
ssh  -i ~/.ssh/id_EFP -o IdentitiesOnly=yes -o CertificateFile=~/.ssh/id_login.deucalion.macc.fccn.pt-cert.pub user@login.deucalion.macc.fccn.pt
```

Troubleshooting

"You do not have any resource entitlements"

If the SSH CA portal shows this message after login, your account is not yet entitled to any resources for SSH access. Check your status in EFP Allocations before opening a support ticket:

Confirm you are a member of a project that has an allocated resource. See Managing your project(s).
Open the project and confirm the resource itself looks healthy (allocation present, Terms of Service accepted where required).
Click your name in the top-right corner → Credentials → Remote accounts, and check the remote account for the system you want to reach.

If the remote account state is Creating, provisioning is still in progress. Wait for it to finish, then refresh the SSH CA portal.

If you are not in a project, the resource is not ready, or the remote account stays in an error state (or Creating for a long time, over half a day), contact support and include what you see under Remote Accounts.