I'm following along a rather good text about SSH certificates written for RHEL 6 and
openssh-5.3p1-94.el6 (which makes it about 10 years old) while trying to mimic the examples on my OpenBSD-current system.
One of the examples shows creating a host CA key and then signing the host's RSA key:
ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -Z host_name.example.com -V -1w:+54w5d /etc/ssh/ssh_host_rsa.pub Enter passphrase: Signed host key /root/.ssh/ssh_host_rsa-cert.pub: id "host_name" serial 0 for host_name.example.com valid from 2015-05-15T13:52:29 to 2016-06-08T13:52:29
When I tried this on OpenBSD, I don't get the
for host_name.example.com output. The text says that
-Zoption restricts this certificate to a specific host within the domain.
... and I'm a bit confused about this as the OpenBSD manual for
ssh-keygen(1) never mentions a
-Z option at all. I'm also confused about
ssh-keygen accepting this undocumented option without complaining.
Looking at the source code for
-Z option is accepted but seems to have something to do with a "format cipher" (or possibly "cipher format") rather than with a hostname (provided that I'm looking at the correct code):
case 'Z': openssh_format_cipher = optarg; break;
Looking at older versions of the code, it has always had something to do with "format cipher".
The release notes for OpenSSH do not mention
ssh-keygen on RHEL 6 (I'm not sure the release is relevant, but the equivalent documentation about SSH certificates for RHEL 7 or RHEL 8 seems not to be available) patched with RedHat-only patches that makes
-Z act differently?