Hi,

the changelog for 8.8 gives a detailed hint on how to re-enable RSA for some older  host with respect to keypair auth but does not mention certificate auth anywhere.

For ssh certificates using RSA-CERT, the "workaround" to re-enable RSA looks slighty different, the required algorith is "ssh-rsa-cert-v01@openssh.com" and having only "ssh-rsa" does not suffice.

To completely enable both for an older host, the config snippet looks like this:

    Host old-host
        HostkeyAlgorithms +ssh-rsa,ssh-rsa-cert-v01@openssh.com
        PubkeyAcceptedAlgorithms +ssh-rsa,ssh-rsa-cert-v01@openssh.com

Would be great if the manpages / documentation could give a more direct statement in this regard for anyone using RSA-CERTs.


Thanks to "BasketCase" on irc://libera#openssh for quickly pointing me in the right direction.


Cheers.