Re: anyone using certificates with an empty principals section?
Jörn Heissler <[email protected]>
| Newsgroups | gmane.network.openssh.devel |
|---|---|
| Message-ID | <anb9IFrZWBzraYHH@wanda> |
On Sat, Aug 08, 2026 at 07:52:01 +0000, Ashutosh Ghosh via openssh-unix-dev wrote: > I'm very late to this party, sorry! I have been using host certificates with empty principals and today I got the first user with an OpenSSH 10.3 client report an issue (I think macOS 26.6 released a few days ago is bundling OpenSSH 10.3p1). > > I think the way this patch is implemented makes it impossible to have a backwards compatible host certificate. If I set the principals to "*", then a pre-10.3 client will not accept it; if I don't set it to "*" for a wildcard certificate then a post-10.3 client will not accept it. > > For my use case, the hostname and IP address are not stable so I don't have a way to express the set of valid hostnames in advance. > > Am I missing something? Is there a way to issue a certificate that is effectively a wildcard for both old and new clients? Hi, did you try creating a cert with two principals, "" and "*"? The better alternative would be to make your hostname stable somehow. Perhaps the HostKeyAlias client option can help you with that. Jörn _______________________________________________ openssh-unix-dev mailing list [email protected] https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev