I'm trying to use SSH using signed certificates. I'm using
ssh -i keys/client.key to connect to the target device. If I generate a public key from that private key (with
ssh-keygen -y -f keys/client.key) and place that in the .ssh/authorized_keys file I'm able to connect with no issue.
What I'm trying to do is use the CA to allow all keys signed by that CA to log in as that user. I used
ssh-keygen -y -f keys/ca.key to generate a public key and put it into authorized_keys as "cert-authority sh-rsa AAAB3N.....Z". My understanding from different sites is that it should now "work", except that it doesn't. On the client side I just get "Permission denied (publickey).". I have no other listings in the
authorized_keys file. On the server side I don't get any error message and only a message that the client disconnected.
Am I missing something simple? How can I debug why it's not working.
I generated the private keys with EasyRSA which is some shell scripts over openssl calls. I think the issue may be that the private key was generated, then a CSR, then a signed certificate. Therefore, I don't think the private key is "signed" in any sort of fashion.
ssh-keygen -s ca.key -I key client.key and I get 'do_ca_sign: unable to open "client.key"'. I tried it with a freshly generated RSA key made by
ssh-keygen and it worked fine so the ca.key seems to be okay. I'm thinking there's something about the openssl generated private key that it doesn't like.