Renewing an SSH certificate

Palo Alto Networks SSH Manager · vSSH CLI

Renewing an SSH certificate

vssh certificate renew issues a fresh certificate for a credential already on disk. By default it checks how much validity remains and skips renewal if it is too early, so you can run it on a schedule without issuing a new certificate every time.

For the full command reference, see certificate.

Renew when little validity remains

vssh certificate renew /etc/ssh/ssh_host_ed25519_key-cert.pub --expires-in 30d

--expires-in accepts either a duration of remaining life (30d, 2w, 1d) or a percentage of validity used (70%, the default). Use 0 or --force to renew regardless.

The "not due yet" exit code

If the certificate does not need renewal, renew exits with code 5 and does not contact the CA. A scheduled job can use this to tell "renewed" from "nothing to do":

vssh certificate renew /etc/ssh/svc_app_key-cert.pub --expires-in 30d --no-prompt
rc=$?
[ "$rc" -eq 5 ] && exit 0   # not due yet
exit "$rc"

See Understanding return codes.

Reload a service on success

--execute runs a command only after a successful renewal, so a service reloads only when the certificate actually changed:

vssh certificate renew /etc/ssh/deploy_key-cert.pub \
  --execute "systemctl reload deploy.service"

Generate a new key

By default renew reuses the existing key pair. To rotate the key as well, add --rekey:

vssh certificate renew /etc/ssh/deploy_key-cert.pub --rekey

Unattended renewal

Run renew from cron or a systemd timer. It reuses the values from the existing certificate unless you override them, so the scheduled command stays short. For a full worked example with JWT authentication, see CI/CD automation.

# /etc/cron.d/svc-app-cert
0 * * * * svc-app vssh certificate renew /etc/ssh/svc_app_key-cert.pub --expires-in 30d --no-prompt >> /var/log/svc-app-cert.log 2>&1

Related pages

• certificate
• Understanding return codes
• CI/CD automation
• Machine identity for apps and hosts