I am looking to implement signed certificates for SSH authentication. I have followed the steps here and am now trying to figure out how I am going to implement it on my systems.
As an example, we have two environments: Production and Testing; each with their own "user key" to sign other keys. I want to be able to control who can access each environment, but the inconvenience I am running into is allowing one user to access both environments with the same private key.
From the man page of 'ssh' under '-i identity_file':
ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames
This seems to imply that I would have to have multiple copies of the private key (just named differently) and name the cert file accordingly in addition to adding a .ssh/config file entry in order for it to use the correct cert.
It is my understanding that if you specify multiple IdentityFile entries in the .ssh/config, ssh will try each of them. However, there doesn't seem to be an option (at least none I can find in the documentation) to specify a cert.
Is there a way to either specify a certificate file (other than the assumed -cert.pub) in the .ssh/config or a file that contains a list of certs to check?