# SSH Client Key Signing error in Vault 1.5.0

**URL:** <https://discuss.hashicorp.com/t/ssh-client-key-signing-error-in-vault-1-5-0/12048>\
**Category:** Vault\
**Created:** [July 28, 2020, 2:48am UTC](https://discuss.hashicorp.com/t/ssh-client-key-signing-error-in-vault-1-5-0/12048 "2020-07-28T02:48:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![qoolqool](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/qoolqool/32/9470_2.png) [@qoolqool](https://discuss.hashicorp.com/u/qoolqool)\
**Post date:** [July 28, 2020, 2:48am UTC](https://discuss.hashicorp.com/t/ssh-client-key-signing-error-in-vault-1-5-0/12048/1 "2020-07-28T02:48:20Z")

</div>

When configuring SSH Client Key Singing with Vault version 1.5.0, it was not functioning.  
Got the following error in the sshd side  
userauth\_pubkey: key type [ssh-rsa-cert-v01@openssh.com](mailto:ssh-rsa-cert-v01@openssh.com) not in PubkeyAcceptedKeyTypes [preauth]

I use similar method in 1.4.3 which does not give me any issue.

Anyone experience the same?

Thanks.

---

<div class="post-metadata">

**Author:** ![qoolqool](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/qoolqool/32/9470_2.png) [@qoolqool](https://discuss.hashicorp.com/u/qoolqool)\
**Post date:** [July 30, 2020, 7:01am UTC](https://discuss.hashicorp.com/t/ssh-client-key-signing-error-in-vault-1-5-0/12048/2 "2020-07-30T07:01:52Z")

</div>

Some update.

When testing the ssh client key signing locally (where vault server running), it works as per expectation.

What is blocking it when access from different host?

…

---

<div class="post-metadata">

**Author:** ![qoolqool](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/qoolqool/32/9470_2.png) [@qoolqool](https://discuss.hashicorp.com/u/qoolqool)\
**Post date:** [July 30, 2020, 1:42pm UTC](https://discuss.hashicorp.com/t/ssh-client-key-signing-error-in-vault-1-5-0/12048/3 "2020-07-30T13:42:27Z")

</div>

More update.

Tested with Centos8 and everything works as expected.  
For some reason, RHEL8 was not preferred.  
RHEL8 does comes with OpenSSH\_7.8p1, OpenSSL 1.1.1 FIPS 11 Sep 2018 while Centos8 comes with OpenSSH\_8.0p1, OpenSSL 1.1.1c FIPS 28 May 2019

However, after upgrading the OpenSSH s/w version to 8.0p1, SSH client key signing still not working in RHEL8.

---

<div class="post-metadata">

**Author:** ![mikegreen](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mikegreen/32/3160_2.png) [@mikegreen](https://discuss.hashicorp.com/u/mikegreen)\
**Post date:** [July 30, 2020, 4:11pm UTC](https://discuss.hashicorp.com/t/ssh-client-key-signing-error-in-vault-1-5-0/12048/4 "2020-07-30T16:11:37Z")

</div>

Which algo are you using?  
Check this out, I think was changed recently… Does RHEL \> 8 support ssh-rsa?

> <https://github.com/hashicorp/vault/pull/8383>

---

<div class="post-metadata">

**Author:** ![qoolqool](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/qoolqool/32/9470_2.png) [@qoolqool](https://discuss.hashicorp.com/u/qoolqool)\
**Post date:** [August 1, 2020, 9:12am UTC](https://discuss.hashicorp.com/t/ssh-client-key-signing-error-in-vault-1-5-0/12048/5 "2020-08-01T09:12:23Z")

</div>

@mikegreen, thanks for the hint.  
got it workaround with  
CASignatureAlgorithms ssh-rsa  
in sshd\_config