I'm trying to use SSH using signed certificates. I'm using ssh -i keys/client.key
to connect to the target device. If I generate a public key from that private key (with ssh-keygen -y -f keys/client.key
) and place that in the .ssh/authorized_keys file I'm able to connect with no issue.
What I'm trying to do is use the CA to allow all keys signed by that CA to log in as that user. I used ssh-keygen -y -f keys/ca.key
to generate a public key and put it into authorized_keys as "cert-authority sh-rsa AAAB3N.....Z". My understanding from different sites is that it should now "work", except that it doesn't. On the client side I just get "Permission denied (publickey).". I have no other listings in the authorized_keys
file. On the server side I don't get any error message and only a message that the client disconnected.
Am I missing something simple? How can I debug why it's not working.
Edit #1
I generated the private keys with EasyRSA which is some shell scripts over openssl calls. I think the issue may be that the private key was generated, then a CSR, then a signed certificate. Therefore, I don't think the private key is "signed" in any sort of fashion.
Edit #2
I tried ssh-keygen -s ca.key -I key client.key
and I get 'do_ca_sign: unable to open "client.key"'. I tried it with a freshly generated RSA key made by ssh-keygen
and it worked fine so the ca.key seems to be okay. I'm thinking there's something about the openssl generated private key that it doesn't like.