OpenSSH supports signing user keys with a certificate authority. From
ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication. Certificates consist of a public key, some identity information, zero or more principal (user or host) names and a set of options that are signed by a Certification Authority (CA) key
In a pure Linux environment SSH certificates are quite easy to use. No problem for the server part (
TrustedUserCAKeys) and on the client side
ssh -i does the right job.
I need to be able to use OpenSSH certificates from a Windows SSH client (the project is to deliver short-living SSH certificates to sysadmins Windows workstations after they have authenticated themselves using a company specific auth scheme).
Cygwin is not an option (killing a fly with a hammer, and probably not acceptable by Windows admins), PuTTY does not recognize OpenSSH certificates.
What would be other options?