OpenSSH User Certificates (HashiCorp Vault) with YubiKey PKCS#11 Authentication on macOS

OpenSSH User Certificates (HashiCorp Vault) with YubiKey PKCS#11 Authentication on macOS

avatar
robertmuehlbauer

Hello,
we are currently evaluating the SSH functionality of Remote Desktop Manager for macOS and are experiencing an issue with a setup based on
OpenSSH User Certificates,
Openbao Vault, and a
YubiKey PIV smart card.

Environment

  • Remote Desktop Manager: 2026.3.1.2
  • Operating System: macOS 27.0.1
  • SSH Server: OpenSSH_8.9p1 Ubuntu
  • Authentication:
    • User certificates issued by Openbao Vault SSH CA
    • Certificate validity: 24 hours
    • Private key stored on a YubiKey PIV
    • PKCS#11 provider: /usr/local/lib/libykcs11.dylib


Working OpenSSH Configuration
The following OpenSSH configuration works correctly from the macOS terminal:

PKCS11Provider /usr/local/lib/libykcs11.dylib

Host *
    IdentityFile ~/.ssh/vault-ssh-cert.pub


The user certificate is regularly renewed via Vault and stored as:

~/.ssh/vault-ssh-cert.pub


When connecting with the native OpenSSH client, the authentication succeeds.
OpenSSH debug output shows:

Offering public key:
/Users/user/.ssh/vault-ssh-cert.pub RSA-CERT

Server accepts key:
/Users/user/.ssh/vault-ssh-cert.pub RSA-CERT

using private key "Public key for PIV Authentication" for certificate

Enter PIN for 'YubiKey PIV':

Authentication is then successful.

RDM Configuration

In RDM we configured:

Global Settings

Smart card PKCS library:
/usr/local/lib/libykcs11.dylib


SSH Session

Host: server.interhyp-intern.de
Username: user

Use smart card: Enabled
Use SSH authentication agent: Enabled

Certificate type:
File (local)

Certificate:
~/.ssh/vault-ssh-cert.pub

Private key type:
No private key


RDM Log Output

The RDM log shows that the YubiKey and PKCS#11 provider are successfully detected:

Trying smartcard authentication
Opening PKCS11 provider: /usr/local/lib/libykcs11.dylib

Available smartcard keys: 5


However, the authentication fails before any PIN prompt appears:

Validating public key: rsa-sha2-512
Key is not accepted by server

Validating public key: rsa-sha2-512
Key is not accepted by server

Validating public key: ssh-ed25519
Key is not accepted by server

No keys accepted by server: 6 tried

The session then falls back to password authentication.

Question

Does the SSH engine used by Remote Desktop Manager for macOS support:

  1. OpenSSH User Certificates (ssh-rsa-cert-v01@openssh.com / RSA-CERT)?
  2. SSH certificates issued by a HashiCorp Vault SSH CA?
  3. Authentication using an OpenSSH user certificate combined with a YubiKey PIV key via PKCS#11?


Based on the logs, it appears that RDM successfully discovers the smart card keys but does not offer the OpenSSH certificate (vault-ssh-cert.pub) to the server in the same way as the native OpenSSH client.

Could you please confirm whether OpenSSH User Certificates are supported by the macOS SSH engine and, if so, provide the correct configuration for this authentication model?

Thank you for your assistance.

Best regards,

Robert

All Comments (0)