anyone using certificates with an empty principals section?

[Brian Candler]

On 08/08/2026 20:20, Ashutosh Ghosh via openssh-unix-dev wrote:
> For some situations yes, but hosts that I am concerned about are embedded devices with no DNS/name resolution capabilities who can only be accessed by IP address (and their IP address is whatever they get from DHCP)

Does it work for a pre-10.3 client to do:

ssh -o "HostKeyAlias=*" -o StrictHostKeyChecking=yes 1.2.3.4

when the certificate contains "*" as the principal?

If so, perhaps you could put those options in ~/.ssh/config under a host 
pattern which matches the IP address range(s) that your DHCP devices use.