GNOME Bugzilla – Bug 697464
Gnome-keyring doesn't support OpenSSH certificates
Last modified: 2018-03-09 15:43:42 UTC
OpenSSH 5.4 added support for _certificates_, an extremely useful feature not to be confused with keys, back in March 2010. You can read about them here, among other places: http://blog.habets.pp.se/2011/07/OpenSSH-certificates Unfortunately, a) gnome-keyring masquerades as ssh-agent and b) has never heard of ssh certificates. Which leads to this perplexing behavior: $ ssh-add id_rsa Enter passphrase for id_rsa: Identity added: id_rsa (id_rsa) Error reading response length from authentication socket. Certificate id_rsa-cert.pub (mpm) add failed Certificate added: id_rsa-cert.pub (mpm) Note the last two lines contradict each other. And the certificate doesn't get added: $ ssh-add -l 4096 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx id_rsa (RSA) ..and the following in auth.log: Apr 6 17:07:40 calx gnome-keyring-daemon[3522]: unsupported algorithm from SSH: ssh-rsa-cert-v01@openssh.com Replacing SSH_AUTH_SOCK with the real ssh-agent socket gives the correct, functional behavior: $ ssh-add id_rsa Enter passphrase for id_rsa: Identity added: id_rsa (id_rsa) Certificate added: id_rsa-cert.pub (mpm) $ ssh-add -l 4096 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx id_rsa (RSA) 4096 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx id_rsa (RSA-CERT)
gnome-keyring should just wrap stock ssh-agent to solve this problem: https://bugzilla.gnome.org/show_bug.cgi?id=775981
This is a problem for me as well. And wrapping the existing ssh-agent would seem like a far better solution. In the meantime my workaround is to turn ssh support off, but this isn't ideal. https://wiki.gnome.org/Projects/GnomeKeyring/Ssh
To be specific, this is a problem for cashier ( https://github.com/nsheridan/cashier ). This makes ssh key management more secure and manageable - which is not something a keyring project should get in the way of. The changes for wrapping ssh-agent seem like a great solution to this problem (and a few others for other key types) so home those branches get merged. Thanks!