Bug 2728 - HostKeyAlias not respected for certificate authority host key validation
Summary: HostKeyAlias not respected for certificate authority host key validation
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: 7.5p1
Hardware: All All
: P5 normal
Assignee: Damien Miller
URL:
Keywords:
: 2359 (view as bug list)
Depends on:
Blocks: V_7_6
  Show dependency tree / graph
 
Reported: 2017-06-13 00:42 AEST by Antonio Russo
Modified: 2018-05-11 13:49 AEST (History)
3 users (show)

See Also:

Attachments
Patch to respect HostKeyAlias when using host certificates (591 bytes, patch)
2017-06-13 00:42 AEST, Antonio Russo 		no flags Details | Diff
with documentation (2.08 KB, patch)
2017-06-23 14:04 AEST, Damien Miller 		dtucker: ok+
Details | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Antonio Russo 2017-06-13 00:42:52 AEST 
Created attachment 2994 [details]
Patch to respect HostKeyAlias when using host certificates

When connecting to ssh server by IP address (or another DNS name), with HostKeyAlias set to the name of the principal signed by the CA, one gets:

> key_cert_check_authority: invalid certificate
> Certificate invalid: name is not a listed principal

The proposed patch changes this behavior by using options.host_key_alias in the contingency that it is set.
Comment 1 Antonio Russo 2017-06-21 22:51:25 AEST 
Is this HostKeyAlias behavior intentional? If it is, is there a way to specify which principal should be expected on a host key certificate? 

Should another configuration option be introduced to preserve pre-existing configurations' behavior?

Is there anything that I can do to help this process?
Comment 2 Damien Miller 2017-06-23 14:04:19 AEST 
Created attachment 2998 [details]
with documentation

Add documentation, match style(9)
Comment 3 Damien Miller 2017-06-24 15:50:23 AEST 
Patch applied, this will be in OpenSSH 7.6.
Comment 4 Damien Miller 2018-04-06 12:26:43 AEST 
Close all resolved bugs after release of OpenSSH 7.7.
Comment 5 Damien Miller 2018-05-11 13:49:10 AEST 
*** Bug 2359 has been marked as a duplicate of this bug. ***