[JENKINS-26600] Add support for SSH signed user public keys

The plugin now supports SSH login using publickey authentication.

In our build network, we sign our SSH server (aka host) public keys and user public keys from an (SSH) CA.

This allows

1. accepting (signed) server-certificates without user interaction (accepting server public key fingerprint)

2. password-less login of users to servers (without need to copy the public key to the server).

This work perfectly using ssh from jenkins master host.

When using the Jenkins SSH Credentials Plugin:

• The first part either
  
  
  
  • works or
  
  
  • the plugin always accepts unknown server public keys.
  
  
  
  


• The second part does not work:
  
  
  
  • When configuring public key authentication, it tries publickey authentication, but when this fails it does not try publickey with certificate authentication.
  
  
  
  

Note

http://www.jcraft.com/jsch/ does not list support for ssh-rsa-cert-v01@​openssh.com (signed publickey with certificate) host key types.

---
Originally reported by tom_ghyselinck, imported from: Add support for SSH signed user public keys

• status: Open
  
• priority: Major
  
• component(s): ssh-credentials-plugin
  
• label(s): ssh, ssh_exchange_identification
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 20251215-193512
  

Raw content of original issue

The plugin now supports SSH login using publickey authentication.


In our build network, we sign our SSH server (aka host) public keys and user public keys from an (SSH) CA.


This allows

1. accepting (signed) server-certificates without user interaction (accepting server public key fingerprint)

2. password-less login of users to servers (without need to copy the public key to the server).


This work perfectly using ssh from jenkins master host.


When using the Jenkins SSH Credentials Plugin:



	
The first part either

	


		
works or

		
the plugin always accepts unknown server public keys.

	

	

	
The second part does not work:

	


		
When configuring public key authentication, it tries publickey authentication, but when this fails it does not try publickey with certificate authentication.

	

	



Note

http://www.jcraft.com/jsch/ does not list support for ssh-rsa-cert-v01@openssh.com (signed publickey with certificate) host key types.