2

I'm a bit confused regarding the order of things to make this happen.

This is what I had in mind:

1 - Generate CA public and private key.

2 - Use CA Public Key with SFTP server (TrustedUserCAKeys).

3 - Generate a user private + public key.

4 - Sign user private key using CA.

5 - Connect to the SFTP server using the private key, username and winscp.

Should this work?

Improve this question

1 Answer 1

Reset to default
3

CAs sign the public key (producing a certificate). They never see the signee's private key.

Besides that, the workflow seems correct, except for the WinSCP part.

The certificates used by TrustedUserCAKeys are a format invented by OpenSSH. Currently no other software supports this kind of certificate authentication – here's the PuTTY wishlist entry for them. Because WinSCP uses PuTTY as its SSH core, it does not have OpenSSH certificate support, and won't have it until PuTTY does.

Improve this answer
9
  • I'm awake of that. It means that I will have to convert the key to a ppk format, which WINSCP offers right out of the box as it detects something else.
    – JustAGuy
    Nov 15, 2018 at 13:46
  • I guess I'll have to give it a go now :) Cheers.
    – JustAGuy
    Nov 15, 2018 at 13:46
  • I am not talking about the OpenSSH key format. Converting the key alone gives you nothing, because the client still won't be able to send the signed certificate to the server.
    – user1686
    Nov 15, 2018 at 13:47
  • That sounds strange... If the conversion is useless then why is it offering it automatically? Better yet, what would it take to do it right?
    – JustAGuy
    Nov 15, 2018 at 13:52
  • 1
    @JustAGuy There's Microsoft build of OpenSSH for Windows.
    – Martin Prikryl
    Nov 15, 2018 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.