I have a gpg key I use through a smartcard (yubikey neo) to ssh to many hosts. Some of these hosts use certificates as well as keys to authorize logins. For normal keys that are stored locally there are three files involved:
I cause ssh to use the .pub and -cert.pub files together to authenticate by specifying the private key file
-i ~/.ssh/id_rsa. this causes it to offer woth the public key and the certificate. like so:
debug1: Authentications that can continue: publickey debug1: Offering RSA-CERT public key: /home/user/.ssh/id_rsa debug1: Server accepts key: pkalg firstname.lastname@example.org blen 1086 debug1: ssh_rsa_verify: signature correct
when the private key is stored on the smart card there is no such file to offer, and the certificate is not sent even though the RSA key signed by the certificate is being offered:
debug1: Next authentication method: publickey debug1: Offering RSA public key: cardno:000XXXXXXX2
Which is rejected for lack of a signature.