Home / server / Questions / 1132019
Accepted
Andrei Andriushin
Asked: 2023-05-27 03:31:11 +0800 CST

Sign windows-based SSH public key

  • 772

Does anybody successfully configured OpenSSH on Windows with CA signed host certificates? OpenSSH doesn't use this signed certificate in my case.

I tried:

  1. Sign generated by OpenSSH public certificate sing Hashicorp Vault.
  2. Issue certificate key pair with the same ssh engine in Vault.

In a both ways OpenSSH on Windows writes error: sshd: error: Public key for PROGRAMDATA/ssh/ssh_host_ed25519_key does not match private key.

ssh-keyscan from another host shows that Windows host returns short key which is not signed and dinamically generated based on private key

windows

1 Answers

  1. Best Answer

    Signed public keys should be named with "cert" at the end. For example, ssh_host_ed25519_key-cert.pub. Unfortunately, it's not clearly described in openssh docs. You can find it in ssh-keysign manual: https://man.openbsd.org/ssh-keysign.8

    • 0