SSH via cert-authority

Question

I'm trying to use SSH using signed certificates. I'm using ssh -i keys/client.key to connect to the target device. If I generate a public key from that private key (with ssh-keygen -y -f keys/client.key) and place that in the .ssh/authorized_keys file I'm able to connect with no issue.

What I'm trying to do is use the CA to allow all keys signed by that CA to log in as that user. I used ssh-keygen -y -f keys/ca.key to generate a public key and put it into authorized_keys as "cert-authority sh-rsa AAAB3N.....Z". My understanding from different sites is that it should now "work", except that it doesn't. On the client side I just get "Permission denied (publickey).". I have no other listings in the authorized_keys file. On the server side I don't get any error message and only a message that the client disconnected.

Am I missing something simple? How can I debug why it's not working.

Edit #1

I generated the private keys with EasyRSA which is some shell scripts over openssl calls. I think the issue may be that the private key was generated, then a CSR, then a signed certificate. Therefore, I don't think the private key is "signed" in any sort of fashion.

Edit #2

I tried ssh-keygen -s ca.key -I key client.key and I get 'do_ca_sign: unable to open "client.key"'. I tried it with a freshly generated RSA key made by ssh-keygen and it worked fine so the ca.key seems to be okay. I'm thinking there's something about the openssl generated private key that it doesn't like.

Answer 1

1. Your client is not presenting a certificate, because it doesn't have one. You need to generate one (ssh-keygen -s keys/ca.key -I jruser -n jruser keys/client.key.pub). The new certificate (keys/client.key_cert.pub) will automatically be picked up by ssh and presented to the server.
2. Your cert-authority line in authorized_keys lacks the required principals assignment (e.g. principals="jruser").
3. To debug it, you can use ssh -v as usual. The authentication algorithms have "cert" in their names when certificate authentication is being used.
4. I suggest using the TrustedUserCAKeys option (in sshd_config) instead of writing cert-authority lines, because it's the older and more well-tested form of ssh user certificates.

A good concise guide to setting this up (and host key certificates as well) is How To Create an SSH CA to Validate Hosts and Clients with Ubuntu.

Answer 2

There seems to be multiple issues going on here...

The primary confusion is that you sign public keys and not private keys. If you try to sign a private key named "id_rsa" ssh-keygen will just ignore that and use "id_rsa.pub" in the same directory. If that public key isn't there, it just gives you the same error message if you tried signing a file that didn't exist.

Also, when signing in, if you use a private key called "some.key", your signed public key needs to be called "some.key-cert.pub" and be in the same directory or else it won't use that and the whole thing doesn't work.

As for "principals"... If you have them (they're optional), they specify what users you can actually log in as. So, if you sign the public key with principals then you can only use that to sign in as those users.