Credentials & SSH keys

Availability All editions — Community and up.

Requires the manage targets permission.

Per-target credentials

Every target carries the credential the controller uses to reach it — an SSH login, a database login, a Windows login, or a cluster token. Set it from Credentials on the target. Secrets are encrypted at rest and are never returned after saving; to rotate, enter a new value.

See Targets & credential injection for how the credential is used at connect time.

SSH key library

Rather than pasting the same private key into many SSH targets, store it once in the SSH Keys library and reference it from any target:

1. Go to SSH Keys → Add key, give it a name, and paste the private key (with passphrase if needed).
2. Tessera records the public key and fingerprint; the private key is encrypted at rest.
3. On a target’s Credentials, choose the key by reference and set the SSH username.

Benefits:

• Rotate in one place — update the key once and every target using it follows.
• No key sprawl — the private key lives only on the controller, encrypted, and can be used by bastions too.

Rotation

Rotating a target’s secret or a library key takes effect for all new connections immediately — there is nothing to redistribute to users, because for SSH, Kubernetes and databases the secret never leaves the controller.

For RDP, rotation applies to every issuance after it, but a password already handed to a user’s client stays valid on the target until you change it there — which is the same as any password someone has already seen. Rotate on the Windows host as well if that is the concern.