Is it possible to restrict the use of CA certificates to specific users/principals/groups?

The use case is that I'd like to have 2 CA certificates. One would be used as part of an automated system to sign user keys. If this certificate were to be compromised, I want to be sure that it couldn't be used to allow someone to log into an admin account.

The other CA certificate would obviously be more securely stored (airgapped etc.) and used for admin accounts.

  • Just so I understand: you want to make sure that if CA1 erroneously certifies a public key for user root, it still would not work? Commented Jan 13, 2018 at 18:14
  • 1
    According to sshd docs, TrustedUserCAKeys is valid in Match sections, so I think that Match User root should work? Commented Jan 13, 2018 at 18:18

1 Answer 1


Based on Ulrich Schwarz's comment:

If I add normal users to an endusers group, then I can set the sshd_config like this:

TrustedUserCAKeys /etc/ssh/admin_ca.pub
Match Group endusers
    TrustedUserCAKeys /etc/ssh/user_ca.pub

This results in the user_ca only being accepted for users in the endusers group, while the admin_ca can be used for any user.

  • But you do not have to match the normal users for the protection you asked for but the admin accounts. Commented Jan 14, 2018 at 15:53
  • Both works. But, I'd rather restrict the less secure CA to a specific group of restricted users. That way I can be certain that this CA will never be used to log into any other account that may have less restrictions (admin or otherwise).
    – Sam Bull
    Commented Jan 14, 2018 at 20:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .