Problem
OpenSSH 10.3 no longer accepts a host certificate without any principal. See release note https://www.openssh.org/txt/release-10.3.
The user would get the TOFU warning message even though the CA public key is in the known hosts file.
$ ssh -p 51594 -o UserKnownHostsFile=known_hosts_local 127.0.0.1
Certificate lacks principal list
The authenticity of host '[127.0.0.1]:51594 ([127.0.0.1]:51594)' can't be established.
ED25519 key fingerprint is: SHA256:oWb35ShJoTFgKBvzuW9xHoP5luR++dufz0BAt/1V63Q
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])
Desired behavior
The user shouldn't see this warning. The Gateway host certificate should include the resource address and aliases.
Why not a wildcard principal
OpenSSH 10.3 also "fixes interpretation of wildcard characters in certificate principals ... Now they are consistently implemented for host certificates", so a single * principal would satisfy 10.3. However, earlier versions do not handle wildcard principals consistently, so * still fails to verify on older clients. Signing the resource address and aliases works on every version.
Problem
OpenSSH 10.3 no longer accepts a host certificate without any principal. See release note https://www.openssh.org/txt/release-10.3.
The user would get the TOFU warning message even though the CA public key is in the known hosts file.
Desired behavior
The user shouldn't see this warning. The Gateway host certificate should include the resource address and aliases.
Why not a wildcard principal
OpenSSH 10.3 also "fixes interpretation of wildcard characters in certificate principals ... Now they are consistently implemented for host certificates", so a single
*principal would satisfy 10.3. However, earlier versions do not handle wildcard principals consistently, so*still fails to verify on older clients. Signing the resource address and aliases works on every version.