An ssh key operation failed Caused by: invalid time

[chmac]

I'm trying to use an SSH CA certificate and in the logs I'm seeing an error like this:

An ssh key operation failed Caused by: invalid time

My CA has no expiry. Could that be the issue? I couldn't find "invalid time" as a string anywhere in this repo via GitHub search. But maybe it is somewhere, or maybe it's in an upstream library.

[nresare]

Good evening!

The message "An ssh key operation failed" has propagated from the ssh-agent-client-rs crate, which in turn wraps the ssh_key::Error type from the ssh-key crate. It is used when reading certificates and keys from the ssh-agent and when parsing the bytes returned from the agent into a Signature struct.

Maybe you could download the ssh-agent-client-rs crate and run cargo run --example list while making sure that the environment variable SSH_AUTH_SOCK references the socket that connects to your ssh-agent? This should list the certificates and public keys that your ssh-agent knows of. If this operation reproduces the problem you reported originally, this means that have somewhat limited the scope of the investigation.

[chmac]

I'm not sure how to download and run crates. But I tried signing a new certificate with an expiry, and then I could successfully authenticate against pam-ssh-agent.

I've had a brief look into the code, and I think I found where the error is generated here:
https://github.com/RustCrypto/SSH/blob/3261319b340aa3ccf17cf23db684716eb0db8055/ssh-key/src/error.rs#L130

I also found an issue saying that ssh-key fails to parse certificates without an expiration here RustCrypto/SSH#174

But that issue was fixed in Jan 2025, but it looks like 0.6.7 (the latest) version of ssh-key was released in 2024-10-15. So at a guess, this fix has not landed in the stable ssh-key release yet. There are pre and rc releases, and I've asked if there's any idea when a stable release will land. It will include breaking changes though, so I guess it won't be a completely smooth upgrade path.

Would it be overkill to add a warning on the readme that certificates without an expiry are currently not supported?

[nresare]

I think I'm keen to understand more specifically what happens before we go about adding warnings etc. Would it be possible for you to detail the steps you used to generate the ssh certificates that causes the problem?

[chmac]

Sure, you just omit the -V parameter like so:

ssh-keygen -s ca -I 'KEY_NAME' -n user key.pub

While if I generate it like so:

ssh-keygen -s ca -I 'KEY_NAME' -n user -V +520w key.pub

Without the -V it fails, but with -V then it succeeds.

[nresare]

Great. I can now reproduce the problem locally.

And you are exactly right about the fix being lined up for ssh-key 0.7.0. It is a shame that the whole RustCrypto upgrade that has been in the works for many months now blocks these kinds of fixes.

I have updated the README.md in the main branch with a little note about this

[chmac]

Awesome! It sounds like the 0.7.0 release will land in the next month or two, so hopefully the fix works its way into pam-ssh-auth sometime later this year.

Also, thanks a lot for this project. I was a great fan of pam ssh agent auth, but it was lacking the modern key types and other issues, so finding pam-ssh-auth and learning it supports certificates was really great. It makes sudo so much easier when combined with secretive on a Mac!