SUMMARY

net-ssh's host-certificate verifier (Net::SSH::HostKeyEntries::CertAuthority#matches_key?)

checks exactly two things when a server presents an OpenSSH certificate (*-cert-v01@openssh.com) under a @cert-authority trusted-CA entry: (1) the cert is self-consistently signed (signature_valid?), and (2) its embedded signature_key equals the trusted CA key. It performs none of the checks OpenSSH applies in sshkey_cert_check_authority:

• valid_principals is never matched against the target host/IP,
• the validity window (valid_after / valid_before) is never checked,
• the cert type is never verified to be a HOST cert (a :user cert is accepted),
• critical_options are never enforced.

Those fields are parsed by Certificate.read_certblob but never read by the verifier. The practical consequence: anyone who holds any certificate signed by a CA the victim trusts for host H can impersonate H — even if their cert was issued for a different principal, is expired, or is a user certificate. This is an authentication bypass (not a DoS): after matches_key? returns true the exchange-hash signature is verified against the cert's underlying public key, which the attacker possesses (it is their cert), so the attacker is authenticated as H and owns the post-auth channel (capturing any credentials the client sends).

Reachable by default: *-cert-v01@openssh.com types head DEFAULT_ALGORITHMS[:host_key] and @cert-authority host-certificate trust is a documented, supported feature.

Credit

Reported by zhangph (GitHub afldl), 2026-08.