Certificates that manage themselves.
Per-organization CA with automatic issuance, rotation, and revocation. No manual key management — ever.
- Per-org User CA + Host CA
- Short-lived certificates (12h user, 30d host)
- Automatic rotation
- One-click revocation
Users authenticate, hosts prove identity.
Each organization gets a dedicated User CA and Host CA — all automatic.
User Certificates
Short-lived (12h) certificates issued on login. Users never touch SSH keys — meshr handles issuance and rotation transparently.
Host Certificates
Longer-lived (30d) certificates for servers and devices. Proves host identity to connecting users — no more TOFU warnings.
From issuance to revocation, automated.
Zero manual steps.
Issue
Certificate issued automatically when a user logs in or a host registers.
Use
Certificate authenticates SSH connections. No passwords, no keys to manage.
Rotate
Before expiry, a new certificate is issued seamlessly. Zero downtime.
Revoke
One click to revoke any certificate. Instant propagation across all hosts.
Every certificate in one pane.
View, search, and manage all certificates. Revoke instantly, rotate on demand.
Just-in-time sudo, recorded.
Root access on demand — not by default. Engineers request elevation in the moment, a peer or policy approves it, the certificate is reissued with elevated claims, and every command runs under an audit trail.
- Time-boxed elevation (10 min / 1 hr / 4 hr presets)
- Approval rules — auto-approve in dev, require peer in prod
- Reason-required field captured in the audit log
- Elevated session keystrokes recorded automatically
Pairs with Session Recording and Audit Logs — every elevated minute is replayable.
Replay missing rows in orders_v2 from staging snapshot.
Ticket: INC-4821 · TTL: 30 min
Kill the long-lived SSH key.
Every feature is unlocked while we're in beta. No credit card, no commitments.