[FEAT] - Allow specifying identity file and certificate

Is this feature for paramiko acting as a client or a server?

Client

What functionality does this feature request relate to?

Keys/auth

For client-side features, does this relate to a specific type of SSH server?

No response

If you're using paramiko as part of another tool, which tool/version?

No response

Desired behavior

If a server is set up to require SSH certificates there are cases where a single private key might have different certificates per server. Right now, as far as I can tell, there is no way to deal with this in Paramiko other than duplicating the private key so that the file names can be found automatically in Paramiko.

Example:
my_key
my_key_server1-cert.pub
my_key_server2-cert.pub

Since there is no way to specify the key and the certificate together, I know have to copy the key so that I have:
my_key
my_key_server1
my_key_server1-cert.pub
my_key_server2
my_key_server2-cert.pub

In an automated environment, with potential dozens of different servers, this can get really chaotic really quick.

Therefore I think Paramiko's connect method should have an explicit field to provide a certificate. The developer can then either provide a private key, or provide a certificate (and have the private key get found automatically) or provide both and have Paramiko use the specified combination.

Anything else?

No response

Start at Paramiko's connect method and trace its existing private-key and certificate filename handling. Done means callers can explicitly supply a certificate, rely on automatic private-key discovery, or provide both as a selected combination, without duplicating private-key files.