ssh-keygen -t ed25519 -C user-CA -f user-CA
user CA setup (as root on ssh servers):
- copy user-CA.pub to /etc/ssh
- echo "TrustedUserCAKeys /etc/ssh/user-CA.pub" >/etc/ssh/sshd_config.d/99-user-CA.conf
+ cat user-CA.pub >>/etc/ssh/trusted-user-ca.keys
+ echo "TrustedUserCAKeys /etc/ssh/trusted-user-ca.keys" >/etc/ssh/sshd_config.d/99-user-CA.conf
user key generation:
ssh-keygen -t ed25519 -C <key comment> -f <key file>
ssh-keygen -t ed25519 -C host-CA -f host-CA
host CA setup (as root on ssh clients):
- echo "@cert-authority *.usr.user.hu <contents of host-CA.pub>" >/etc/ssh/ssh_known_hosts
+ echo "@cert-authority *.usr.user.hu <contents of host-CA.pub>" >>/etc/ssh/ssh_known_hosts
host key signing (as root on ssh servers):
ssh-keygen -h \