Using the option AddKeysToAgent loads key data, but not certificate data, into ssh-agent when a certificate is used to authenticate a session. Such a certificate thus cannot be used with agent forwarding unless manually loaded via ssh-add. Manual loading works as expected. Reproduction setup: foo and bar both accept keys signed by the same Certificate Authority. Each has a unique keypair signed by the same Certificate Authority. Manual (working): me@foo:~$ ssh-add ~/.ssh/id_ed25519 Enter passphrase for /home/me/.ssh/id_ed25519: Identity added: /home/me/.ssh/id_ed25519 (me@foo) Certificate added: /home/me/.ssh/id_ed25519-cert.pub (me@foo.local) me@foo:~$ ssh-add -L ssh-ed25519 x me@foo ssh-ed25519-cert-v01@openssh.com x me@foo.local me@foo:~$ ssh -A -v -o AddKeysToAgent=no me@bar.local ... debug1: Offering public key: /home/me/.ssh/id_ed25519 ED25519-CERT SHA256:x agent debug1: Server accepts key: /home/me/.ssh/id_ed25519 ED25519-CERT SHA256:x agent debug1: Authentication succeeded (publickey). ... me@bar:~$ ssh-add -L ssh-ed25519 x me@foo ssh-ed25519-cert-v01@openssh.com x me@foo.local me@bar:~$ ssh -A -v -o AddKeysToAgent=no me@foo.local ... debug1: Offering public key: me@foo ED25519-CERT SHA256:x agent debug1: Server accepts key: me@foo ED25519-CERT SHA256:x agent debug1: Authentication succeeded (publickey). ... me@foo:~$ AddKeysToAgent (not working): me@foo:~$ ssh-add -L The agent has no identities. me@foo:~$ ssh -A -v -o AddKeysToAgent=yes me@bar.local ... debug1: Offering public key: /home/me/.ssh/id_ed25519-cert.pub ED25519-CERT SHA256:x debug1: Server accepts key: /home/me/.ssh/id_ed25519-cert.pub ED25519-CERT SHA256:x Enter passphrase for /home/me/.ssh/id_ed25519: debug1: identity added to agent: /home/me/.ssh/id_ed25519 debug1: Authentication succeeded (publickey). ... me@bar:~$ ssh-add -L ssh-ed25519 x me@foo me@bar:~$ ssh -A -v -o AddKeysToAgent=yes me@foo.local ... debug1: Will attempt key: me@foo ED25519 SHA256:x agent .... debug1: Offering public key: me@foo ED25519 SHA256:x agent ... (authentication fails, or a local key is picked)
Created attachment 3617 [details] Patch for the ssh agent certificate fix I have written a patch for this bug and a pull request has been created to merge it into master. The patch is attached