Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows Server Root Certificate Authority, Linux SSH server, and users with Windows SSH clients. The Linux box is not part of the AD domain (and probably never will be [sigh])

OpenSSH 5.4 and above supports X.509 certiicate based authentication. I am trying to find a way to use my Windows Certificate Authority to issue certificates for authentication of the users when the SSH to the Linux box.

I do not want to have to generate a keypair on each user's desktop. And we want the certificates controlled and revokable at the Windows CA.

My question is not exactly the same as SSH from Windows to Linux with AD certificates (and the referenced seems to be down)

I have searched Google a lot, and haven't found much results about how to accomplish this. An answer doesn't necessarily have to include a full tutorial, even some hints about what to search on or pointers to some references may be helpful.

share|improve this question
Sorry if it should be obvious: What's your question exactly?? – Chris S Aug 14 '12 at 20:14
I updated your question a bit. I hope I haven't changed it too much, but I believe my edits make it clearer what you are looking for. – Zoredache Aug 14 '12 at 20:37
I don't think there's any way to use client SSL certificates without generating keys on the clients; if the client doesn't have a key, how is it going to prove that it owns the certificate? (However, it may be possible to get Windows to generate these keys silently on demand.) – Harry Johnston Aug 14 '12 at 22:17
It seems to me that the key component here is the SSH client. What SSH client are you using, and have you checked the documentation / vendor's web site / vendor's support forum? – Harry Johnston Aug 14 '12 at 22:18
I would suggest that you instead use a configuration management tool to manage the contents of ~/.ssh/authorized_keys on your servers. That way you can use it for server to server traffic as well as from any ssh client or ssh tool (eg. to integrate with a monitoring solution such as SCOM). – Cameron Kerr May 24 '15 at 10:08

Between OpenSSH 5.4's readme and Roumen Petrov it does not appear that it is available to the extent you are looking for at this date. It also appears that OpenSSH isn't all that interested in supporting it.

That being said, you maybe able to make it happen if you install the forked version Petrov provides.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.