search for: cert_princip

...ssing principal ID"); exit(1); } - return sig_match_principals(identity_file, cert_key_id, - opts, nopts); + return sig_match_principals(identity_files, + nidentity_files, cert_key_id, opts, nopts); } else if (strncmp(sign_op, "sign", 4) == 0) { /* NB. cert_principals is actually namespace, via -n */ if (cert_principals == NULL || @@ -3645,6 +3693,10 @@ main(int argc, char **argv) "missing key"); exit(1); } + if (nidentity_files > 1) { + error("Too many keys specified for sign"); + exit(1); + } return...

Hello, I'm currently evaluating using `ssh-keygen -Y verify` to check OS artifacts (e.g. packages) and I noticed that the `-f allowed_signers_file` option can be passed only once. A side remark: technically it can be passed multiple times without a warning but the last invocation overrides all previous ones. Tested using: $ ssh-keygen -Y verify -f allowed_signers -f /dev/null -n file -s

...ason; } if ((finalopts = sshauthopt_merge(keyopts, certopts, &reason)) == NULL) - goto fail_reason; + goto cert_fail_reason; /* * If the user has specified a list of principals as @@ -361,12 +361,12 @@ auth_check_authkey_line(struct passwd *pw, struct sshkey *key, if (keyopts->cert_principals != NULL && !match_principals_option(keyopts->cert_principals, key->cert)) { reason = "Certificate does not contain an authorized principal"; - goto fail_reason; + goto cert_fail_reason; } if (sshkey_cert_check_authority_now(key, 0, 0, 0, keyopts->c...

Hi, I don't see any way to view the details of a certificate once it is generated. Having such a capability would be very handy for debugging purposes to check what constraints, principals, and validity interval are associated with a given cert. -- Iain Morgan

On 4/5/25 15:01, Lars Nood?n wrote: > I notice that when using log level INFO it seems sshd(8) provides very > little information about failed SSH certificate log in attempts: > > Apr? 5 14:44:41 server sshd-session[51695]: error: Certificate invalid: > not yet valid > > Apr? 5 14:45:31 server sshd-session[88953]: error: Certificate invalid: > expired > >

...@ main(int argc, char **argv) convert_format = FMT_PEM; break; } + if (strcasecmp(optarg, "SUBJECTINFO") == 0) { + convert_format = FMT_SUBJECTINFO; + break; + } fatal("Unsupported conversion format \"%s\"", optarg); case 'n': cert_principals = optarg; -- 1.7.8.6