To report a problem or share an idea, use Issues; if you have a suggestion for fixing the issue, please include those details, too.
vSSH CLI is a command line tool that requests SSH certificates from Palo Alto Networks SSH Manager and puts them to work. It authenticates to the service, gets a short-lived SSH certificate from an issuance template, and loads it into your OpenSSH agent or writes it to disk. It also configures OpenSSH servers to trust the SSH certificate authority (CA), retrieves CA public keys, and manages access tokens.
The tool replaces long-lived SSH keys with certificates that expire on their own — no key to rotate manually and no authorized_keys file to maintain per host. A server trusts the CA once, and every valid certificate the CA issues is accepted until it expires.
vSSH CLI is tested against the latest release of Palo Alto Networks SSH Manager. General functionality of the latest release works with SSH Manager (TPP) 23.1 or higher.
Download the archive for your platform from the latest release, extract it, and place vssh on your PATH.
Linux (x64):
curl -L "https://github.com/Venafi/vssh-cli/releases/latest/download/vssh_linux_amd64.zip" -o vssh.zip && unzip -o vssh.zip && sudo install -m 0755 vssh /usr/local/bin/vsshmacOS (Apple silicon):
curl -L "https://github.com/Venafi/vssh-cli/releases/latest/download/vssh_darwin_arm64.zip" -o vssh.zip && unzip -o vssh.zip && sudo install -m 0755 vssh /usr/local/bin/vsshOther platforms and full instructions, including how to verify release integrity, are in Installing or updating to the latest version.
Configure a profile once, then log in and connect. (An administrator must first complete the prerequisites, and the target host must trust the CA.)
$ vssh profile configure --url https://tpp.example.com --user alice --template-login "Users - Web Admins"
$ vssh login
$ ssh alice@web.example.comSee Interactive user access for the full walkthrough.
Full documentation lives in the project wiki.
- Getting started — Installing or updating · Adding vSSH to your PATH · Prerequisites
- Configuration — Configuration profiles · Command line options · OpenSSH authentication agent · Configure OpenSSH server
- Authentication — Authentication methods
- Guides — Securing SSH access · CI/CD automation · SSH server administration
- Tutorials — Interactive user access · Machine identity for apps and hosts · CI/CD pipeline enrollment
- Command reference — Overview and global options · Return codes
Copyright © 2026 Palo Alto Networks, Inc. All rights reserved.
vSSH CLI is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.
Please direct questions/comments to security@venafi.com.