I'm not saying Kerberos isn't good, and obviously it's going to be better than any "new" system -- after all any new system hasn't seen any real-world testing. All the fluff around the various (http-centric) SSO-solutions is partly from wrapping them around SSL/X.509 -- just as IMNHO one of the problems with setting up (a secure and easily maintained) kerberos deployment isn't kerberos but LDAP.
As mentioned up-thread MS AD does a great job of enabling in-house CA and management -- and it's mostly that I want. I want to use certs for auth most places, and I want it easy! Openssh have shown that public key auth doesn't have to be hard -- but also doesn't have a very compelling story around managing access. The new cert-system might be an improvement -- but it absolutely needs some infrastructure around it to be easy to deploy (and verify).
in fact openssh has support for full-blown certificates but its also a little more painful. what makes ssh easy to use is that it doesn't have any central trust authority by default.
you get a fingerprint and you trust it.
if it changes, it warns you.. but in most cases you're going to know why it changed or just accept the change anyway (which is a problem when you admin 10000 servers of course as the warning might be a real issue)
central trust/revocation is still an issue everywhere to this day, i think. both technically ("my client trusts this, but do i?") and from the useability pov.
Well, yes and no. Do you mean the new cert stuff that's in standard openssh? Which has stuff like:
The marker is optional, but if it is present then it must be one of “@cert-authority”, to indicate that the
line contains a certification authority (CA) key, or “@revoked”, to indicate that the key contained on the line
is revoked and must not ever be accepted. Only one marker should be used on a key line.
While certainly simple, it doesn't strike me as very manageable.
As mentioned up-thread MS AD does a great job of enabling in-house CA and management -- and it's mostly that I want. I want to use certs for auth most places, and I want it easy! Openssh have shown that public key auth doesn't have to be hard -- but also doesn't have a very compelling story around managing access. The new cert-system might be an improvement -- but it absolutely needs some infrastructure around it to be easy to deploy (and verify).