Smallstep SSH CA and reverse proxy

[Jaharmi]

If a Smallstep CA were set up only as an SSH CA, would it work through an L7 reverse proxy (like Caddy 2)? Or would it still need an L4 proxy?

I ask because I never got Caddy 2 with the L4 proxy add-on to work with a Smallstep CA Docker container. I only tried it for the x.509 CA.

[tashian]

Whether you're getting an SSH certificate or an X.509 certificate, the client is still going to use HTTPS, and potentially mutual TLS for renewals. See our Production Considerations doc for limitations of using L7 proxying.