I have a gpg key I use through a smartcard (yubikey neo) to ssh to many hosts. Some of these hosts use certificates as well as keys to authorize logins. For normal keys that are stored locally there are three files involved:

  • id_rsa
  • id_rsa.pub
  • id_rsa-cert.pub

I cause ssh to use the .pub and -cert.pub files together to authenticate by specifying the private key file -i ~/.ssh/id_rsa. this causes it to offer woth the public key and the certificate. like so:

debug1: Authentications that can continue: publickey
debug1: Offering RSA-CERT public key: /home/user/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa-cert-v01@openssh.com blen 1086
debug1: ssh_rsa_verify: signature correct

when the private key is stored on the smart card there is no such file to offer, and the certificate is not sent even though the RSA key signed by the certificate is being offered:

debug1: Next authentication method: publickey
debug1: Offering RSA public key: cardno:000XXXXXXX2

Which is rejected for lack of a signature.


If you want to use yubikey NEO to authenticate you to remote servers, there is simple tool and howto, directly from yubico:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.