PowerShell / PowerShell/Win32-OpenSSH
Support for signed certificates?
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
"OpenSSH for Windows" version
OpenSSH_for_Windows_8.0p1, LibreSSL 2.6.5
Client OperatingSystem
Windows 10 Enterprise
Does OpenSSH for Windows support signed certs?
I feel like it does, as ssh-keygen picks up the certificate no problem. However, it doesn't want to connect. The same steps seem to work fine from linux.
Directory of C:\hi
11/04/2019 01:18 PM 2,013 GregDFO-cert.pub
04/16/2019 09:07 AM 1,854 GregDFO-private.key
04/16/2019 09:31 AM 389 GregDFO-public.key
C:\hi>ssh-keygen -Lf GregDFO-cert.pub
GregDFO-cert.pub:
Type: ssh-rsa-cert-v01@openssh.com user certificate
Public key: RSA-CERT SHA256:Ccox9NCf/HBjzFxRE76XsnTT9k0vbmRB4/j5qX95WkQ
Signing CA: RSA SHA256:3axo+wPqiszHOTKy94Tk2gj4S6Rb6uGWKcB4s059bvg (using ssh-rsa)
Key ID: "root"
Serial: 17890926214909873034
Valid: from 2019-11-01T08:52:18 to 2019-11-13T19:52:48
Principals:
cormierg
Critical Options: (none)
Extensions:
permit-pty
However, when trying to use it, ssh spits out invalid format
C:\hi>ssh -i GregDFO-private.key -i GregDFO-cert.pub cormiergr@1.2.3.4
Unauthorized Access Prohibited / Acces non-autorise interdit
Enter passphrase for key 'GregDFO-private.key': *****
Load key "GregDFO-cert.pub": invalid format
A few extra verbose tidbits
Enter passphrase for key 'GregDFO-private.key':
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Offering public key: GregDFO-cert.pub RSA-CERT SHA256:Ccox9NCf/HBjzFxRE76XsnTT9k0vbmRB4/j5qX95WkQ explicit
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: GregDFO-cert.pub RSA-CERT SHA256:Ccox9NCf/HBjzFxRE76XsnTT9k0vbmRB4/j5qX95WkQ explicit
debug1: sign_and_send_pubkey: no separate private key for certificate "GregDFO-cert.pub"
Load key "GregDFO-cert.pub": invalid format
debug2: we did not send a packet, disable method
debug1: Next authentication method: keyboard-interactive
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the Windows command using GregDFO-private.key and GregDFO-cert.pub, then compare its verbose authentication output with the Linux behavior described in the issue. Trace the certificate-loading and signing path to determine whether the Windows client supports this certificate format; done means a confirmed compatibility result or a reproducible defect with a clear scope.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, cli, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100