10.3 empty-principals change leaves no compatible wildcard host certificate; request for review

[Brian Candler]

On 18/10/2026 02:51, Damien Miller wrote:
> Sorry, we don't intend to revert this change or make the old behaviour
> available as an option.
>
> I'd suggest a local patch to bring it back in your environment.

The other approach is to create two certificates, one with empty 
principals and one with "*", for use by different clients - until such 
time as you have no more old clients left.

I haven't tested whether two certs from the same CA would work directly 
- i.e. will clients pass over the one they don't like and continue to 
the other?

If not, there are plenty of workarounds possible - e.g. you could sign 
the two certs with different algorithms, and the client can use 
HostKeyAlgorithms to select the right one. Or use two different CAs. At 
worst, two instances of sshd listening on different ports (AFAICS, 
HostCertificate can't be used in a Match block)