RDM cannot use an OpenSSH certificate signed for an ED25519-SK FIDO2 key

Hello,

I am trying to use a FIDO2-backed OpenSSH key together with an OpenSSH user certificate in Remote Desktop Manager for Windows.

Environment:

• Remote Desktop Manager: 2026.2.17.0
• OpenSSH for Windows: 9.5p2
• Key type: sk-ssh-ed25519@openssh.com
• Certificate type: sk-ssh-ed25519-cert-v01@openssh.com
• Certificate issuer: OpenBao SSH CA
• Hardware authenticator: YubiKey-compatible FIDO2 security key

The FIDO2 key itself works in RDM when I select its OpenSSH private key handle file, as described in your existing FIDO2 support topic.

The same key and certificate also work correctly with OpenSSH for Windows:

ssh -i <key-handle-file> -o CertificateFile=<certificate-file> user@host

OpenSSH requests the FIDO2 PIN and/or touch and successfully connects.

However, when I configure the same private key handle and certificate in an RDM SSH Shell entry, RDM rejects the certificate with this error:

Unknown type for certificate key: sk-ssh-ed25519-cert-v01@openssh.com

The certificate itself is valid and can be inspected → The certificate is also parsed successfully:

ssh-keygen -Lf <certificate-file>

Expected behavior:

RDM should load the sk-ssh-ed25519-cert-v01@openssh.com certificate, use the matching sk-ssh-ed25519@openssh.com key handle, and request the FIDO2 authenticator to sign each SSH connection.

Actual behavior:

RDM recognizes the base FIDO2 key but rejects its OpenSSH certificate type before authentication.

Could you please confirm whether OpenSSH certificates for FIDO2/SK keys are currently supported?

If they are not supported yet, could support for the following certificate types be added?

• sk-ssh-ed25519-cert-v01@openssh.com
• sk-ecdsa-sha2-nistp256-cert-v01@openssh.com

This combination is important because the SSH CA provides short-lived authorization, while the FIDO2 authenticator enforces physical user presence or verification on every connection.