anyone using certificates with an empty principals section?

[Jörn Heissler]

On Sat, Aug 08, 2026 at 07:52:01 +0000, Ashutosh Ghosh via openssh-unix-dev wrote:
> I'm very late to this party, sorry! I have been using host certificates with empty principals and today I got the first user with an OpenSSH 10.3 client report an issue (I think macOS 26.6 released a few days ago is bundling OpenSSH 10.3p1).
> 
> I think the way this patch is implemented makes it impossible to have a backwards compatible host certificate. If I set the principals to "*", then a pre-10.3 client will not accept it; if I don't set it to "*" for a wildcard certificate then a post-10.3 client will not accept it.
> 
> For my use case, the hostname and IP address are not stable so I don't have a way to express the set of valid hostnames in advance. 
> 
> Am I missing something? Is there a way to issue a certificate that is effectively a wildcard for both old and new clients?

Hi,

did you try creating a cert with two principals, "" and "*"?

The better alternative would be to make your hostname stable somehow.
Perhaps the HostKeyAlias client option can help you with that.

Jörn