OpenSSH User Certificates (HashiCorp Vault) with YubiKey PKCS#11 Authentication on macOS

Hello Robert,

Thank you for the detailed description and the logs, they were very helpful.

I have passed your questions to our development team, and I will come back to you as soon as I have their answer. In the meantime, this is where we are:

- OpenSSH user certificates in an SSH entry are used together with their matching private key, with both files set in the session. What I still need to confirm is whether the macOS SSH engine can use a certificate together with a key that stays on a PKCS#11 token such as your YubiKey PIV, which is what the native OpenSSH client does with PKCS11Provider and IdentityFile. I do not want to give you a configuration that may not work, so I am not going to guess on that point.

- Your log shows that RDM finds the 5 smart card keys, but offers them as plain keys, and the certificate is not offered together with the PIV key. This is consistent with the question above, but it is not a confirmed cause yet.

- Regarding the certificates issued by your OpenBao/Vault SSH CA: RDM cannot request the certificate from Vault by itself, so renewing the certificate file remains a step outside RDM. I am also asking the development team whether there is anything specific to consider for certificates issued by Vault.

In the meantime, there is a test that would help us narrow this down:

- Use a test private key file (not the YubiKey) and a certificate signed by your Vault CA for that key.

- In the SSH entry, set the private key as a file, set the certificate as File (local), and turn off "Use smart card" and "Use SSH authentication agent".

- Connect, and send me the session log.

If this connects, we know the certificate part works on macOS and we can focus on the PKCS#11 pairing. If it does not, the log will show us what is different from the native client.

Best regards,

Hey Alexis,

I completed the requested test using a temporary local RSA key pair and a Vault-signed SSH certificate.

Test Setup

I created a temporary RSA key pair:

Private key:
~/.ssh/rdm-vault-test/rdm-vault-test
 
Public key:
~/.ssh/rdm-vault-test/rdm-vault-test.pub

I then used the same Vault signing role that we use in production:

ssh/sign/linux

to generate a signed SSH certificate:

~/.ssh/rdm-vault-test/rdm-vault-test-cert.pub

Certificate details:

Type: ssh-rsa-cert-v01@openssh.com user certificate
Principal: <user redacted>
Validity: 24 hours

Verification with Native OpenSSH

Before testing with RDM, I verified the key/certificate combination using the native macOS OpenSSH client while explicitly disabling the SSH agent and any PKCS#11/YubiKey integration.

The connection succeeded.

Relevant OpenSSH debug output:

loaded identity cert from
rdm-vault-test-cert.pub: RSA-CERT
 
Offering public key:
rdm-vault-test-cert.pub RSA-CERT
 
Server accepts key:
rdm-vault-test-cert.pub RSA-CERT
 
Authenticated to server.intern.de using "publickey"

RDM Test Configuration

As requested, I configured the SSH session as follows:

Private key type:
File (local)
 
Private key:
~/.ssh/rdm-vault-test/rdm-vault-test
 
Certificate type:
File (local)
 
Certificate:
~/.ssh/rdm-vault-test/rdm-vault-test-cert.pub
 
Use smart card:
Disabled
 
Use SSH authentication agent:
Disabled
 
Allow SSH authentication agent forwarding:
Disabled

Result

The connection was successful.

Relevant RDM log entries:

Using provided key data
Using provided SSH certificate

Validating public key:
rsa-sha2-512-cert-v01@openssh.com
 
Received userauth key ok
 
Sending userauth public key signature:
rsa-sha2-512(rsa-sha2-512-cert-v01@openssh.com)
 
User authenticated successfuly using public key method

Conclusion

This appears to confirm that:

• RDM on macOS supports OpenSSH user certificates.

• Vault-signed SSH certificates are handled correctly by RDM.

• The target server accepts the certificate when paired with a local private key.

The issue therefore seems to be specific to the original configuration using:

Vault SSH certificate

+

YubiKey PIV key via PKCS#11

For comparison, the failing YubiKey test produces:

Trying smartcard authentication
Available smartcard keys: 5
 
Validating public key: rsa-sha2-512
Key is not accepted by server
 
No keys accepted by server: 6 tried

whereas the successful local key test shows:

Validating public key:
rsa-sha2-512-cert-v01@openssh.com

This makes me suspect that the smartcard/PKCS#11 workflow may not be associating the configured OpenSSH certificate with the corresponding key on the token.

Please let me know if you would like any additional logs or tests.

Kind regards,

Robert

Hello Robert,

Thank you for running the test and for the detailed logs, they were very helpful.

Your test confirms that the certificate part works on macOS. With a private key file and a certificate signed by your Vault CA, RDM offered the certificate, the server accepted it and the connection succeeded. So OpenSSH user certificates, including the ones issued by your Vault SSH CA, are handled correctly when they are paired with a private key file.

The problem is limited to the combination you originally wanted: a certificate together with a key that stays on the YubiKey through PKCS#11. In that case RDM finds the 5 keys on the token, but it offers them as plain keys and does not pair your certificate with the key on the token, the way the native OpenSSH client does with PKCS11Provider and IdentityFile. Since your server only accepts keys signed by the CA, it rejects them, and that is why no PIN prompt appears and the session falls back to password. We have not found a configuration in RDM that changes this behavior.

I have reported this to our development team with your logs and the results of your test. I cannot give you a date or confirm that a change will be made, and I will let you know if I get an update from them.

In the meantime, if you need to keep using the YubiKey with your certificates, the native OpenSSH client from the terminal remains the option that works for you today. Using a private key file with the certificate in RDM works, but it does not keep the key on the YubiKey, so please consider whether that fits your security requirements.

Please let me know if you have any questions

Best regards,

Hi Alexis,

thanks for the confirmation and for looking into this.

I appreciate the feedback and, of course, hope that a future change will make the YubiKey/PKCS#11 certificate scenario possible in RDM as well.

Thanks again and best regards,

Robert