1Password and SSH_ASKPASS

Fri, 10 Oct 2025 00:00:00 +0000

1Password has an excellent solution for managing SSH keys securely using their 1Password SSH Agent. However I interact with a few devices that either require keyboard-interactive multi-factor authentication (MFA) or force the use of a password instead of accepting keys or certificates.

Thankfully, through the use of the 1Password CLI, the SSH_ASKPASS environment variable, and a little shell script, we can use 1Password to fill in these MFA tokens and passwords too.

The script, op_ssh_askpass further below, is expected to be used as follows:

Understanding automated certificate options

Fri, 16 May 2025 00:00:00 +0000

In April 2025, CA/B Forum ballot SC-081v3 was passed to reduce the maximum certificate validity to 47 days by the 15th of March 2029. The first step will be to reduce the maximum validity period to 200 days by the 15th of March 2026.

There has been a great deal of debate on whether this will be useful or, in some environments, even feasible.

Regardless of our personal opinions on the matter, I think its worth clarifying the options we have today for certificate issuance and renewal. I believe that if you’re aware of all the options, some scenarios where 47-day certificates seemed daunting will become far more achievable.

Security on Jason Stangroome

1Password and SSH_ASKPASS

Understanding automated certificate options