- Host certificates: certificate authorities are trusted per OpenSSH host
pattern (stored as @cert-authority known-hosts rows, matched against
'host' or '[host]:port' as OpenSSH does, with *, ? and !). For a host a
CA covers, the client asks for a certificate; one signed by a matching
CA, of host type, naming the host and in date is trusted without a
first-use prompt, and anything else is refused. Hosts no CA covers keep
the existing key checks. Applies to jump hosts and tunnels too.
- User certificates: <key>-cert.pub next to the configured private key is
used for publickey login (falling back to the plain key).
- Settings → Known Hosts: import ~/.ssh/known_hosts (hashed names and
@revoked lines skipped and counted), export in OpenSSH format, and a
Trust a CA form.
Verified against OpenSSH sshd with ssh-keygen-issued certificates: host
cert accepted without prompting and user-cert login with only
TrustedUserCAKeys; a CA for other hosts falls back to the key check; a
different CA is refused.
Andy Dixon
0fc9451583