Bug 3111

Using the option AddKeysToAgent loads key data, but not certificate data, into ssh-agent when a certificate is used to authenticate a session. Such a certificate thus cannot be used with agent forwarding unless manually loaded via ssh-add. Manual loading works as expected.

Reproduction setup:

foo and bar both accept keys signed by the same Certificate Authority. Each has a unique keypair signed by the same Certificate Authority.



Manual (working):

me@foo:~$ ssh-add ~/.ssh/id_ed25519
Enter passphrase for /home/me/.ssh/id_ed25519:
Identity added: /home/me/.ssh/id_ed25519 (me@foo)
Certificate added: /home/me/.ssh/id_ed25519-cert.pub (me@foo.local)
me@foo:~$ ssh-add -L
ssh-ed25519 x me@foo
ssh-ed25519-cert-v01@openssh.com x me@foo.local
me@foo:~$ ssh -A -v -o AddKeysToAgent=no me@bar.local
...
debug1: Offering public key: /home/me/.ssh/id_ed25519 ED25519-CERT SHA256:x agent
debug1: Server accepts key: /home/me/.ssh/id_ed25519 ED25519-CERT SHA256:x agent
debug1: Authentication succeeded (publickey).
...
me@bar:~$ ssh-add -L
ssh-ed25519 x me@foo
ssh-ed25519-cert-v01@openssh.com x me@foo.local
me@bar:~$ ssh -A -v -o AddKeysToAgent=no me@foo.local
...
debug1: Offering public key: me@foo ED25519-CERT SHA256:x agent
debug1: Server accepts key: me@foo ED25519-CERT SHA256:x agent
debug1: Authentication succeeded (publickey).
...
me@foo:~$



AddKeysToAgent (not working):

me@foo:~$ ssh-add -L
The agent has no identities.
me@foo:~$ ssh -A -v -o AddKeysToAgent=yes me@bar.local
...
debug1: Offering public key: /home/me/.ssh/id_ed25519-cert.pub ED25519-CERT SHA256:x
debug1: Server accepts key: /home/me/.ssh/id_ed25519-cert.pub ED25519-CERT SHA256:x
Enter passphrase for /home/me/.ssh/id_ed25519:
debug1: identity added to agent: /home/me/.ssh/id_ed25519
debug1: Authentication succeeded (publickey).
...
me@bar:~$ ssh-add -L
ssh-ed25519 x me@foo
me@bar:~$ ssh -A -v -o AddKeysToAgent=yes me@foo.local
...
debug1: Will attempt key: me@foo ED25519 SHA256:x agent
....
debug1: Offering public key: me@foo ED25519 SHA256:x agent
...
(authentication fails, or a local key is picked)