During first contact with a server via ssh, the server's public key of the chosen key algorithm is presented to the user to validate it. After validation, the result is usually saved into the
~/.ssh/known_hosts file to counter later MITM attacks.
$ ssh host.example.com The authenticity of host 'host.example.com (126.96.36.199)' can't be established. ECDSA key fingerprint is SHA256:xxxxxxxxxxxxx. Are you sure you want to continue connecting (yes/no)?
This obviously won't help against a MITM attack on the first connection and does just move the problem to the user, who now has to have some process in place to verify the presented public key - and we all know how that ends.
Is it possible to distribute ssh server keys signed with a corporate CA to counter MITM-attacks on first contact? The public-private-key infrastructure with certificate chain supports this in general - but I have never seen it used in a corporate environment to secure ssh servers.
General idea would be to trust a CA key for a set of hosts:
trust *.example.com SHA256:<fingerprint(public key(corporate-ca))>
and every host that fist this and has been signed by the CA is trusted:
ca.example.com +- host.example.com
This is similar to how HTTPS is secured, and since ssh uses the same underlying technology - is something like that already implemented in OpenSSH and I just didn't find it?