Created attachment 2555 [details]
First-draft proposed patch

At present, a SSH certificate signed with the name of a round-robin pool can't be used to authenticate a single, specific host within that pool, if logging into it directly. Likewise, if DNS is temporarily unavailable, one cannot log into a system secured by a host certificate by IP unless its IP address is listed as a principal.

I propose to address this by allowing a a name passed in the HostKeyAlias option to match a system's principal name in the same manner, and using the same logic, as presently used for the name used for the actual lookup and connection.

Proposed on mailing list at http://lists.mindrot.org/pipermail/openssh-unix-dev/2015-February/033443.html.