PowerShell / PowerShell/Win32-OpenSSH
No matching private key for certificate.
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps
Using CA to sign public ssh key to generate ssh host certificate.
Added HostCertificate line in sshd_config file. to prevent TOFU/TUFU message.
When running in foreground everything works and no errors.
But when running as sshd service it fails.
"OpenSSH for Windows" version
8.1.1
8.6.1
8.9.1
Server OperatingSystem
Windows 10 21H2
Client OperatingSystem
Debian 11.3 Bullseye
What is failing
sshd: error: No matching private key for certificate: PROGRAMDATA/ssh/ssh_host_ed25519_key-cert.pub
Expected output
No error. Should just connect without TOFU/TUFU.
Actual output
Get the prevent trust on first use (TOFU) or trust upon first use (TUFU) message.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Troubleshooting Steps and the sshd_config entry for HostCertificate. Compare the foreground and Windows service environments, focusing on why the service reports no matching private key for ssh_host_ed25519_key-cert.pub. Done means the service starts without that error and the Debian client connects without a TOFU/TUFU prompt.
Written by the indexing model from the issue text.
Assessment
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100