OpenSSH supports signing user keys with a certificate authority. From man ssh-keygen:

ssh-keygen supports signing of keys to produce certificates that may
be used for user or host authentication.  Certificates consist of a
public key, some identity information, zero or more principal (user
or host) names and a set of options that are signed by a Certification
Authority (CA) key

In a pure Linux environment SSH certificates are quite easy to use. No problem for the server part (TrustedUserCAKeys) and on the client side ssh -i does the right job.

I need to be able to use OpenSSH certificates from a Windows SSH client (the project is to deliver short-living SSH certificates to sysadmins Windows workstations after they have authenticated themselves using a company specific auth scheme).

Cygwin is not an option (killing a fly with a hammer, and probably not acceptable by Windows admins), PuTTY does not recognize OpenSSH certificates.

What would be other options?

  • Have you tried using ssh-keygen -e? Not sure it works with certificates. – apraetor Nov 11 '16 at 20:01
  • 1
    Same problem here, beause I want to implement exactly the same as you. Do you mind writing a short note what you ended up with? – Daniel May 26 '18 at 9:48

If you can't end up figuring out a way to use the certs with PuTTY. There are lighter-weight ways to get the actual OpenSSH client on a Windows box than Cygwin. The most likely candidate that comes to mind is the Windows distribution of Git.

There's a standard installable version or a portable version that you can just unzip and run. It's basically bash, git, and ssh. Git Bash

Slightly heavier, but at least native to the OS is the Windows Subsystem for Linux which could work if you have Windows 10 anniversary update or later.

  • The microsoft port of OpenSSH is available as a Chocolatey package btw, so handy :) chocolatey.org/packages/openssh – Stephane Martin Nov 14 '16 at 12:01
  • @StephaneMartin - Did it work with Open SSH on windows? – Monojeet Nayak Oct 24 '20 at 5:37
  • @StephaneMartin - It worked now, this thread helped. Open ssh in windows works the same way as linux and looks for certs in the users home directory. – Monojeet Nayak Oct 24 '20 at 8:18

OpenSSH is now supported as "optional feature" in windows 10. Allegedly, OpenSSH 7.6p1 should be available at the usual place: Control Panel, selecting Programs | Programs and Features | Turn Windows features on or off. You can also access this wizard directly by typing "optionalFeatures" from the Windows Start prompt.



Hope they don't kick out certificate authentication, as they apparently did with the OpenSSH server "feature"


From here: https://burnz.wordpress.com/2007/12/14/ssh-convert-openssh-to-ssh2-and-vise-versa/

You can use ssh-keygen -e -f ~/.ssh/id_rsa.pub > ~/.ssh/id_rsa_ssh2.pub to convert keys from OpenSSH to SSH2. Do this server-side before distributing the keys to clients?

At the end of the day you're generating transient .pub keys for the client to use, signed by the certificate, so they just need to be in a format PuTTY will accept.

That's assuming your workflow is something like: https://blog.habets.se/2011/07/OpenSSH-certificates

  • Server is planned to authorize not through a client's public key, but through a signature. How can server receive the raw bytes of the signature from putty? – kubanczyk Nov 11 '16 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.