I want to implement public key authentication with CA and smart card. OpenSSH have their own certificate format, which is not x509.
I have a server (SSHD) and a client. I already made public key authentication happen with CA, now I want to insert into the equation a smart card. I use ARX cryptokit to access the smart card and I want to import my key and certificate into the smart card. When I click "Import key", it says that I need PKCS12 format certificate to import. I tried to convert my OpenSSH certificate and RSA private key to pkcs12 using Openssl, but it isn't accepting my certificate. I saw that it requires PEM encoding but I can't seem to make it happen.
So my questions:
- How do I convert OpenSSH certificate and key to PKCS12?
- Can I actually use smartcards with OpenSSH server and CA and the whole package?
Thanks in advance.
EDIT: I will tell you the commands i wrote so there wont be any misunderstandings
Generating CA keys Ssh-keygen -t RSA -f CA
Generating user keys Ssh-keygen -t Rsa -f User
Signing User key Ssh-keygen -s CA.priv -I identity -n username -V +52W User.pub
Now the output is user-cert.pub I want to turn my certificate and private key to pkcs12 format
Openssl pkcs12 -export -out certificate.pfx -inkey user.priv -in user-cert.pub -certfile CA-cert.pub
CA-cert.pub is self signed certificate i generated the same with generating the user key.
The output of the last command is "unable to load certificates" I tried it without the last part of "-certfile Ca-cert.pub" and the output is still the same.
hope someone has an idea.