robertmuehlbauer

Hi Alexis,

thanks for the confirmation and for looking into this.

I appreciate the feedback and, of course, hope that a future change will make the YubiKey/PKCS#11 certificate scenario possible in RDM as well.

Thanks again and best regards,

Robert

Hey Alexis,

I completed the requested test using a temporary local RSA key pair and a Vault-signed SSH certificate.

Test Setup

I created a temporary RSA key pair:

Private key:
~/.ssh/rdm-vault-test/rdm-vault-test
 
Public key:
~/.ssh/rdm-vault-test/rdm-vault-test.pub

I then used the same Vault signing role that we use in production:

ssh/sign/linux

to generate a signed SSH certificate:

~/.ssh/rdm-vault-test/rdm-vault-test-cert.pub

Certificate details:

Type: ssh-rsa-cert-v01@openssh.com user certificate
Principal: <user redacted>
Validity: 24 hours

Verification with Native OpenSSH

Before testing with RDM, I verified the key/certificate combination using the native macOS OpenSSH client while explicitly disabling the SSH agent and any PKCS#11/YubiKey integration.

The connection succeeded.

Relevant OpenSSH debug output:

loaded identity cert from
rdm-vault-test-cert.pub: RSA-CERT
 
Offering public key:
rdm-vault-test-cert.pub RSA-CERT
 
Server accepts key:
rdm-vault-test-cert.pub RSA-CERT
 
Authenticated to server.intern.de using "publickey"

RDM Test Configuration

As requested, I configured the SSH session as follows:

Private key type:
File (local)
 
Private key:
~/.ssh/rdm-vault-test/rdm-vault-test
 
Certificate type:
File (local)
 
Certificate:
~/.ssh/rdm-vault-test/rdm-vault-test-cert.pub
 
Use smart card:
Disabled
 
Use SSH authentication agent:
Disabled
 
Allow SSH authentication agent forwarding:
Disabled

Result

The connection was successful.

Relevant RDM log entries:

Using provided key data
Using provided SSH certificate

Validating public key:
rsa-sha2-512-cert-v01@openssh.com
 
Received userauth key ok
 
Sending userauth public key signature:
rsa-sha2-512(rsa-sha2-512-cert-v01@openssh.com)
 
User authenticated successfuly using public key method

Conclusion

This appears to confirm that:

• RDM on macOS supports OpenSSH user certificates.

• Vault-signed SSH certificates are handled correctly by RDM.

• The target server accepts the certificate when paired with a local private key.

The issue therefore seems to be specific to the original configuration using:

Vault SSH certificate

+

YubiKey PIV key via PKCS#11

For comparison, the failing YubiKey test produces:

Trying smartcard authentication
Available smartcard keys: 5
 
Validating public key: rsa-sha2-512
Key is not accepted by server
 
No keys accepted by server: 6 tried

whereas the successful local key test shows:

Validating public key:
rsa-sha2-512-cert-v01@openssh.com

This makes me suspect that the smartcard/PKCS#11 workflow may not be associating the configured OpenSSH certificate with the corresponding key on the token.

Please let me know if you would like any additional logs or tests.

Kind regards,

Robert

Hello,

we are currently evaluating the SSH functionality of Remote Desktop Manager for macOS and are experiencing an issue with a setup based on

OpenSSH User Certificates,

Openbao Vault, and a

YubiKey PIV smart card.

Environment

• Remote Desktop Manager: 2026.3.1.2

• Operating System: macOS 27.0.1

• SSH Server: OpenSSH_8.9p1 Ubuntu

• Authentication:

  • User certificates issued by Openbao Vault SSH CA

  • Certificate validity: 24 hours

  • Private key stored on a YubiKey PIV

  • PKCS#11 provider: /usr/local/lib/libykcs11.dylib

Working OpenSSH Configuration

The following OpenSSH configuration works correctly from the macOS terminal:

PKCS11Provider /usr/local/lib/libykcs11.dylib

Host *
    IdentityFile ~/.ssh/vault-ssh-cert.pub

The user certificate is regularly renewed via Vault and stored as:

~/.ssh/vault-ssh-cert.pub

When connecting with the native OpenSSH client, the authentication succeeds.

OpenSSH debug output shows:

Offering public key:
/Users/user/.ssh/vault-ssh-cert.pub RSA-CERT

Server accepts key:
/Users/user/.ssh/vault-ssh-cert.pub RSA-CERT

using private key "Public key for PIV Authentication" for certificate

Enter PIN for 'YubiKey PIV':

Authentication is then successful.

RDM Configuration

In RDM we configured:

Global Settings

Smart card PKCS library:
/usr/local/lib/libykcs11.dylib

SSH Session

Host: server.interhyp-intern.de
Username: user

Use smart card: Enabled
Use SSH authentication agent: Enabled

Certificate type:
File (local)

Certificate:
~/.ssh/vault-ssh-cert.pub

Private key type:
No private key

RDM Log Output

The RDM log shows that the YubiKey and PKCS#11 provider are successfully detected:

Trying smartcard authentication
Opening PKCS11 provider: /usr/local/lib/libykcs11.dylib

Available smartcard keys: 5

However, the authentication fails before any PIN prompt appears:

Validating public key: rsa-sha2-512
Key is not accepted by server

Validating public key: rsa-sha2-512
Key is not accepted by server

Validating public key: ssh-ed25519
Key is not accepted by server

No keys accepted by server: 6 tried

The session then falls back to password authentication.

Question

Does the SSH engine used by Remote Desktop Manager for macOS support:

1. OpenSSH User Certificates (ssh-rsa-cert-v01@openssh.com / RSA-CERT)?

2. SSH certificates issued by a HashiCorp Vault SSH CA?

3. Authentication using an OpenSSH user certificate combined with a YubiKey PIV key via PKCS#11?

Based on the logs, it appears that RDM successfully discovers the smart card keys but does not offer the OpenSSH certificate (vault-ssh-cert.pub) to the server in the same way as the native OpenSSH client.

Could you please confirm whether OpenSSH User Certificates are supported by the macOS SSH engine and, if so, provide the correct configuration for this authentication model?

Thank you for your assistance.

Best regards,

Robert