Identity-led server access using ephemeral certificates for hybrid infrastructure
Experience ephemeral certificate-based server access that replaces static SSH keys and RDP passwords, issuing short-lived credentials per session to managed devices. ScaleFT, from Okta Inc., ties server logins to central identity state and device posture while capturing centralized audit logs. Key components include certificate issuance, RBAC, and automated account lifecycle management. It fits DevOps engineers and security teams who manage multi-cloud or on-premises server fleets and need identity-first access without a traditional VPN.
What does the tool do for server access?
It replaces static credentials with ephemeral certificates by issuing short-lived, session-scoped client certificates for SSH and RDP. The tool automates provisioning and deprovisioning of local server accounts from Okta's identity directory and proxies RDP connections via an access broker service on Windows. It also integrates with standard tooling through an sft proxycommand so OpenSSH, scp, and rsync work without changing existing workflows.
Does it slow down systems during authentication or sessions?
Authentication runs through short certificate exchanges, not heavy local processes, so the client establishes connections rather than performing full system scans. The architecture validates identity, device health, and permissions per request, and the proxy model routes sessions through an access broker for Windows servers. This design limits local CPU overhead during login and avoids continuous background scanning on managed hosts.
Is it safe to use on production machines?
Safety is built into the identity-first model: ephemeral credentials reduce credential sprawl and the product captures detailed login and command logs for audit. The client uses certificate-backed authentication scoped to user and device, and automated lifecycle management removes dormant local accounts, which reduces exposed attack surfaces on production servers.
Do administrators need deep technical knowledge to operate it?
Operational work focuses on identity and access policies rather than manual key rotation. Administrators configure RBAC using user groups and server labels and rely on the central identity directory for provisioning. In addition, the proxycommand compatibility means teams can keep existing SSH tooling while migrating to certificate-based sessions, so the migration path is technical but aligned with standard DevOps practices.
Solid option for identity-centric server access, with a migration caveat
The tool delivers identity-led, short-lived credential management that reduces the risks tied to static SSH keys and VPNs, and it centralizes audit trails for compliance. The clear limitation is that Okta has announced an End of Sale for Advanced Server Access effective May 1, 2026, so organizations should plan a migration path to Okta Privileged Access while using the service for current secure access needs.
