[JENKINS-72254] Add support for SSH Certificates

[jenkins-infra-bot]

Currently the SSH-Agent plugin doesn't support SSH certificates (e.g. RSA-CERT). It can only load private keys. For example below my ssh-add -l command:2048 

2048 SHA256:FINGERPRINT COMMENT1 (RSA)
2048 SHA256:FINGERPRINT COMMENT2 (RSA)
256 SHA256:FINGERPRINT COMMENT3 (ED25519)
2048 SHA256:FINGERPRINT COMMENT4 (RSA-CERT)

It would be nice to load a certificate from the credential manager and add it to SSH-agent.

At this location: https://github.com/jenkinsci/ssh-agent-plugin/blob/878b53c895119c248eac9dd07da155a47aa99c88/src/main/java/com/cloudbees/jenkins/plugins/sshagent/exec/ExecRemoteAgent.java#L92C33-L92C51 a "*-cert.pub" file should be created besides the private key file so ssh-agent will also load the certificate.

When more information is required please ask!

---

Originally reported by joostr, imported from: Add support for SSH Certificates

• status: Open
• priority: Minor
• component(s): ssh-agent-plugin
• resolution: Unresolved
• votes: 0
• watchers: 1
• imported: 20260604-211335

Raw content of original issue

Currently the SSH-Agent plugin doesn't support SSH certificates (e.g. RSA-CERT). It can only load private keys. For example below my ssh-add -l command:2048 

2048 SHA256:FINGERPRINT COMMENT1 (RSA)
2048 SHA256:FINGERPRINT COMMENT2 (RSA)
256 SHA256:FINGERPRINT COMMENT3 (ED25519)
2048 SHA256:FINGERPRINT COMMENT4 (RSA-CERT)

It would be nice to load a certificate from the credential manager and add it to SSH-agent.
At this location: https://github.com/jenkinsci/ssh-agent-plugin/blob/878b53c895119c248eac9dd07da155a47aa99c88/src/main/java/com/cloudbees/jenkins/plugins/sshagent/exec/ExecRemoteAgent.java#L92C33-L92C51 a "*-cert.pub" file should be created besides the private key file so ssh-agent will also load the certificate.
When more information is required please ask!

• environment: Any Jenkins version

[ogulcanaydogan]

Thanks for the detailed report. The <keyfile>-cert.pub mechanism you describe is right, ssh-add would pick the cert up automatically if we wrote it next to the key in addIdentity.

The blocker is on the credential side: SSHUserPrivateKey only exposes getPrivateKeys(), there is no field to store a certificate, so the plugin has nothing to write. To do this cleanly we would first need ssh-credentials to carry the certificate (a new field on the SSH key credential or a dedicated credential type), and then ssh-agent can write the -cert.pub file beside the key.

So this needs a change in ssh-credentials first. Leaving it open with that note, the ssh-agent side is small once the credential can carry a cert.