Is using SSH (PuTTy) secure if I do not have an SSL certificate on server?

Question

We have a small office server running Linux Centos for internal use. I can connect to it externally though using Putty with SSH.

Since the server does not have any kind of SSL certificate, is using putty ssh still secure?

Thanks

Answer 1

SSH does not depend on the SSL notion of signed certificate chains. SSH is using encryption, and certificates . You can also use user certificates instead of password based authentication (recommended).

SSH depends on a TOFU (Time of first use) certificate validation. When you connect to the server, it asks you to verify the key. The client then remembers this key. If the server suddenly presents a different key (possibly a man in the middle attack), you will be unable to connect without manual intervention.