Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to setup SSH (via pam for instance) to check the public key of the connecting client against a CA server? I've tried with gnupg (via gpg-agent --daemon --enable-ssh-support) and also tried working with OpenCA which prooved to be a challenge just to install. Also the documentation is horrific when it comes to both of these.

What i'd like to accomplish is something along the lines of:
[Client] --SSH--> "Server" <---> [CA Server]

The entire platform is *nix based and i'm open to suggestions right about now cause i've been stuck on this for a while now.


I've set it up in a as basic mode as possible following these guides:

My initial thought was to set up my own "key-server" which gpg can send and check for keys, but there's no information about this what so ever (or at least none that i could find).

And from what i understand i should be able to do ssh-add -l to list all my keys, but this gives me: The agent has no identities. which is not so odd because i've never specified where to fetch them but "it should just work"(...?).

The gpg.conf looks like:

... lots of default ...
personal-digest-preferences SHA512
cert-digest-algo SHA512
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
homedir /etc/gnupg

and my gpg-agent.conf:

pinentry-program /usr/bin/pinentry-curses
default-cache-ttl 10800
default-cache-ttl-ssh 10800
write-env-file /etc/gnupg/.gpg-agent-info

And just to verify that i actually have a key and gpg is responding:

~]# gpg --list-keys
pub    4096R/#######2 2013-12-10 [expired: 2014-12-10]
uid                   Anton (...) <mail>
sub    4096R/#######5 2013-12-10 [expires: 2014-12-10]


When finally everything was in place and started, I get to a website that says my "symetric keylength is to short" and I can't get past that.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.