openssh unix dev - Feb 2021 - AuthenticationMethods for ssh certificate

>It's actually 2 factors in our setup, the ssh certificate is created
>using MFA (and have a short lifetime), and the pubkey is the users own
>private key.
>
>This prevents getting into the system if you have control of the MFA
>setup (which is handled by another team) or getting into the system
>without MFA :-)
My understanding was the certificate can only be used in conjunction with the
user's private key anyway? So I think what you're after already happens
automatically.

Eg I have a user set up like this:

$ ls .ssh
config  id_ed25519  id_ed25519-cert.pub  id_ed25519.pub  known_hosts

$ cat .ssh/config
Host repos
User git
Hostname 10.0.0.1
PasswordAuthentication no
PubkeyAcceptedKeyTypes ssh-ed25519-cert-v01 at openssh.com
StrictHostKeyChecking accept-new
IdentityFile ~/.ssh/id_ed25519
IdentitiesOnly yes

When I move the id_ed25519 out of ~/.ssh, I get permission denied:

$ ssh repos
no such identity: <home-directory>/.ssh/id_ed25519: No such file or
directory
git at 10.0.0.1: Permission denied (publickey).

On Wed, Feb 3, 2021 at 2:55 PM asymptosis <asymptosis at posteo.net>
wrote:
> My understanding was the certificate can only be used in conjunction with
the user's private key anyway? So I think what you're after already
happens automatically.
I'd guess the certificate is based on a keypair the user doesn't
control, eg. it's created by the CA when the user auths. so the cert
key and the non-cert key are distinct.