[empty image] [empty image]
[empty image]
[empty image] [empty image] [empty image]
[empty image]

secure shell with
X.509 v3 certificate support



10 Mar 2016 : Version x509-8.9
What's new:
  • fixes for Android OS
    Rewrite detection of /dev/ptmx and use device on android.
    Replace bionic stubs ttyname and ttyname_r with working implementation.
  • builds with upcoming OpenSSL 1.1
    The version builds fine with current(master branch) versions of OpenSSL library.
    For alpha version you should rename EVP_CIPHER_CTX_get_cipher_data to EVP_CIPHER_CTX_cipher_data, i.e. without _get.
  • includes openssh 7.2p2
    With bug fix sshd - sanitise X11 authentication credentials to avoid xauth command injection when X11Forwarding is enabled.

29 Feb 2016 : Version x509-8.8
What's new:
  • pkcs11 module support EC keys
    PKCS11 module could use EC based X.509 certificates and keys either from command line (ssh -I argument) for from agent (loaded with ssh-add -s ...).
    PKCS11 engine is still supported but current implementation can not be used in all possible OpenSSL configurations.
  • improved support of pkcs11 module
    Use context extra data specific to ssh to avoid clash with default context. Note that default context could be used by OpenSSL library itself.
    RSA method is based exactly on OpenSSL RSA method not default one. Note that default RSA method could be provided by loadable cryptographic module(engine).
  • builds with upcoming OpenSSL 1.1
    It could be build with 1.1 alpha 1,2 and 3 versions of OpenSSL library.
  • LDAP tests for Solaris
    Note that build with OpenLDAP is supported only.
  • includes openssh 7.2p1
    You could build with define EXPERIMENTAL_RSA_SHA2_256 to enable experimental support for rsa-sha2-256 and rsa-sha2-512 public key algorithms. Note that those algorithms are be managed yet with options like PubkeyAlgorithms or HostbasedAlgorithms.
  • configure option compatibility
    Accept bogus openssh arguments --without-openssl and --with-ssh1.
    Note that build with --without-openssl will fail as support for X.509 certificates requires OpenSSL as cryptographic library. Please use --enable-ssh1 instead ambiguous --with-ssh1.

16 Jan 2016 : Version x509-8.7
What's new:
  • builds with upcoming OpenSSL 1.1
    OpenSSL version 1.1 is major change of API - almost all structures are opaque. Application has to use accessors functions to manipulate structure attributes. Note that OpenSSL library is in alpha stage.
    Version 8.7 of PKIX-SSH is first version that builds with OpenSSL 1.1. It could be build with OpenSSL aplha versions 1.1.0-pre1 and 1.1.0-pre2 and regression tests pass.
  • includes openssh 7.1p2

23 Aug 2015 : Version x509-8.6
What's new:
  • support for ssh-dss in client
    Previous version does not keep properly support for ssh-dss in list announced by client to server. This version completely restore ssh-dss in client including dump of configuration.
  • based on openssh 7.1p1

12 Aug 2015 : Version x509-8.5
What's new:
  • based on openssh 7.0p1
  • support for ssh-dss
    Public key algorithm ssh-dss is defined as required for secure shells. For compatibility with commercial implementations PKIX-SSH will continue to support it in default configuration .
  • portability fixes
    Precise autoconf macros that detect supported compiler and linker flags to minimize impact over detection process from flags specified by user. As result of correction GNU C compiler flag like -fPIE and linker -pie should be detected. This could impact linking with FIPS enabled OpenSSL library. In such case you could configure with --without-pie.
    Minimize undefined functions - result of some optimizations in included headers.
    Proper implementation of statvfs and fstatvfs for Android and perhaps other platforms.

1 Jul 2015 : Version x509-8.4
What's new:
  • dump X.509 purpose
    Server(sshd) output properly AllowedCertPurpose in extended test mode(option -T).
  • look up by LDAP errors and reasons
    Properly initialize offset of error codes and reasons in OpenSSL look up method X.509 'By LDAP'.
  • ECDSA for OpenSSL 0.9.8+(compatibility)
    With implementation of custom EVP digest methods X.509 EC certificates could be used in OpenSSL 0.9.8 versions.
  • EC keys from engine(experimental)
    OpenSSL engine support now could use EC keys from external devices.

1 April 2015 : Version x509-8.3.1
What's new:
  • pattern matching for public key algorithms
    Reimplementation of pattern matching added for first time in 8.3. Now options PubkeyAlgorithms and HostbasedAlgorithms accept patterns for X.509 key algorithms.
  • allowed algorithms, match block and privilege separation
    Integration of some compatibility options in 8.3 adds regression in options PubkeyAlgorithms and HostbasedAlgorithms - values from match block are not transferred properly to privilege process. Integration of compatibility options is revised in 8.3.1.
  • some improvements from base
  • regression test
    Updated to use more generic names for distinguished name items.

18 Mart 2015 : Version x509-8.3
What's new:
  • Version 8.3 includes OpenSSH 6.8p1
    Continue refactoring of key-related functions to be more library-like.
    Minimum supported OpenSSL version is 0.9.7.
  • pattern in allowed algorithms
    Version 5.4 published on 24 November 2004 (for more details see news archives), implement for first time new server options PubkeyAlgorithms and HostbasedAlgorithms to restrict allowed protocol version 2 algorithms in public-key or host-based authentication. Also PubkeyAlgorithms is available in client. With version 8.2 format is changed to accept wildcard pattern with default value *, i.e. allowed all algorithms. Note that wildcard pattern format is backward compatible with previous lists.
    For consistency version 8.2 adds new client option - HostbasedAlgorithms. The default value of client options is *, i.e. allowed all algorithms. Both client options also support pattern matching.
  • OpenSSL engine support
    With code refactoring of key-related functions to be more library-like in version 8.2 broke engine support. Now code of engine related functions is refactored and support is restored.
  • Portability
    This version adds some portability improvements for born shell scripts used in regression tests.

23 November 2014 : Version x509-8.2
What's new:
  • Version 8.2 includes OpenSSH 6.7p1
    OpenSSH 6.7p1 refactor key-related functions to be more library-like.
    Also OpenSSH 6.7p1 drop TCP-wrappers and adds requires at lest OpenSSL 0.9.8f to build.
  • Minimum OpenSSL version - 0.9.7
    PKIX-SSH drop support for OpenSSL 0.9.6. It continue to support OpenSSL 0.9.7 and all 0.9.8 with wrapper functions for missing or buggy functionality. Note that engine functionality in OpenSSL 0.9.7 is not so stable and in some host configurations load of OpenSSL engines may fail.
  • TCP-wrappers support
    PKIX-SSH continue to support TCP-wrappers.
  • Support ECDSA X.509 keys in agent
    Unfortunately version 8.1 was released without support in agent. Version 8.2 correct this mistake.
  • Portability fixes
    Correction is in regression tests to use more portable command invocation.
    Also detection of "unix" netcat in multiplex tests is improved. Now tests pass on solaris.
    Note that netcat commands used in linux distributions does not fulfill yet requirement of multiplex regression test.
  • How to build with FIPS enabled OpenSSL on Solaris 11
    PKIX-SSH pass all test on Solaris 11 using FIPS enabled OpenSSL with following configuration:
    CONFIG_SHELL=/bin/ksh \
    CC='gcc -m64' \
    CPPFLAGS='-I/usr/include/openldap -I/usr/include/openssl/fips-140' \
    .../configure \
    --enable-ldap --with-ldap-libs='-lldap-2.4 -llber-2.4' --with-ldap-libexecdir=/usr/lib \
    --enable-openssl-fips \
    --enable-x509v3-ecdsa ...
    Note that compiler flag -m64 is required for build with FIPS enabled OpenSSL library.

29 September 2014 : Version x509-8.1
What's new:
  • remove EVP_dss1raw as does not work with OpenSSL 1.0.2 in FIPS mode
    OpenSSL 1.0.2 does not export any more FIPS EVP structures. This impact custom implemenation of EVP_dss1 with signature encoding according SSH norms. In version 8.1 EVP_MD struture dss1raw is replaced with wraper for OpenSSL methods EVP_SignFinal and EVP_VerifyFinal that recode signature according SSH norms.
  • support fipscheck library
    Red Hat-and Red Hat based distribution like CentOS use own FIPS validated OpenSSL implementation and own process for verification if FIPS mode based of fipscheck library.
  • restore arc4random in FIPS mode
    Unfortunately replacement of of RC4 based arc4random* functions in version 7.8 based on OpenSSH 6.5p1 does not follow previous rules. Regression is corrected in this version 8.1 based on OpenSSH 6.5p1.
  • ssh-keysign avoid dependency from "X.509 store" objects
    Now dependencies of ssh-keysign to external libraries are minimized.
  • search know host file by key subtype
    Search for host keys in know host file is enhanced to take into account curve used for EC keys.

11 August 2014 : Version x509-8.0
What's new:
  • Implementation of x509v3-ecdsa-sha2-* keys
    Version 8.0 start to support of x509v3-ecdsa-sha2-* public key algorithms as described in [RFC6187]. You could use configure with --enable-x509v3-ecdsa to enable by default support of those keys.
    For public key algorithms defined in [RFC6187] identity file has to contain X.509 certificate that match private key and chain of certificates leading to a trusted certificate authority.
  • engine and OpenSSL 1.0.1g
    Since OpenSSL version 1.0.1g engines are register internally as result engine support was broken due to attempt to register again. Now pkix-ssh durring engine initialization check whether an engine is registered internally before to request its registration.
  • new distribution model
    Version 8.0 is distributed as complete source package. Authenticity of tar archive could be checked with pgp key <pkixssh-announce@roumenpetrov.info>

Features (valid for latest version) :

  • public key algorithms:
    • x509v3-sign-rsa
    • x509v3-sign-dss
    • x509v3-ecdsa-sha2-nistp256
    • x509v3-ecdsa-sha2-nistp384
    • x509v3-ecdsa-sha2-nistp521
    RSA, DSA or ECDSA X.509 certificates could be used as "user identity" and/or "host key" in SSH "Public Key" and "Host-Based" authentications.
    • different "x509v3-sign-rsa" signatures
      As support for SHA-1 and MD5 signature format PKIX-SSH is interoperable with implementations from multiple vendors. Both formats are supported because "SSH Transport Layer Protocol" internet drafts does not specify signature format in case of X.509 certificate for RSA key.
    • different packing of "x509v3-sign-dss" signature
      PKIX-SSH is interoperable with implementations from multiple vendors. It support DSA signatures packed in format as is described in [RFC2459] and "dss_signature_blob" format as is specified in "SecSH Transport" draft and [RFC4253].
      Note "SSH Transport Layer Protocol" internet draft before version 12 specify "x509v3-sign-dss" public key algorithm to use signature format as is described in [RFC2459], i.e. r and s packed in ASN.1 SEQUENCE. Some vendors pack DSA signature values in "dss_signature_blob" as is specified in "SecSH transport" draft for "ssh-dss" signature.
    • use key and certificate stored in "external devices"
      Implementation requires working OpenSSL engine. The identity used in client authentication could refer to external key and/or certificate in format engine:[ENGINE_NAME]:[CERT_CRITERIA], where [ENGINE_NAME] is name of OpenSSL engine and [CERT_CRITERIA] is specific to engine search criteria to find the key and certicate.
      For instance you could use "friendly name" to access key and certificate stored in "Network Security Services (NSS)" database with e_nss engine from http://roumenpetrov.info/e_nss/. NSS s used in programs(web-browser. e-mail client) like Firefox, SeaMonkey, Thunderbird.
    • "PKCS#11"module
      As second option PKIX-SSH could use PKCS#11 shared library(module) to communicate with EC or RSA X.509 certificates and private key provided by PKCS#11 tokens.
  • verification (default feature)
    By default server(sshd) and clients(ssh,scp,sftp) always verify signatures and validity of certificates in chain when a X.509 certificate is used in authentication. When verification fail that certificate is disallowed. Certificate verification can be disabled when PKIX-SSH is build without "X.509 store" support. Ofr instance at configure script is run with --disable-x509store option. In additional client is able to verify remote key using DNS with CERT RR (resource record).
  • validation
    • CRL (default feature)
      When a X.509 certificate is used in authentication, server and client always verify signatures and validity of existing CRLs issued by authorities in certificate chain. Certificate is allowed only when no one of certificates in the chain is revoked. Validation is disabled only when PKIX-SSH is build without "X.509 store" feature.
    • OCSP (default feature)
      Additional validation is performed when PKIX-SSH is configured to use OCSP and a X.509 certificate is used in authentication.
    ssh can verify host identification using CERT Resource Record published in DNS.
  • PKIX-SSH Agent (ssh-agent and ssh-add programs)
    Authentication agent can hold X.509 certificates.
  • ssh-keyscan
    This tools can gather in addition following X.509 host keys:
    • x509v3-sign-rsa
    • x509v3-sign-dss
    • x509v3-ecdsa-sha2-nistp256
    • x509v3-ecdsa-sha2-nistp384
    • x509v3-ecdsa-sha2-nistp521
  • ssh-keysign
    This tools used in "Host-Based Authentication" can sign "host keys" containing X.509 certificate (RSA, DSA, ECDSA).
  • ssh-keygen
    when user identity contain a X.509 certificate, command:
    • creates public key and proposed "SECSH Public Key File Format" for that certificate.
    • shows fingerprint of certificate.
    • prints CERT RR (resource record) for specified hostname.
  • regression tests
  • manual pages
  • README.x509v3
    Brief description of server and client configuration, regression tests, troubleshooting and FAQ.

Get your version from download pages.


  • to implement wildcards(patterns) for DN in "authorized keys" and "known hosts" files;
  • to extend "time limits" with specified time for given revoked certificates.


  1. Initial
    Initial support began from 4 Apr 2002 with version "a". Version "b" issued on 11 Jun 2002 add "X509 store". The store is in use in verification process when a certificate is used as user's identity is ssh session. The store allow use of "distinguished name" in authorized keys file.
  2. Second stage
    In this phase certificate support is implemented in other PKIX-SSH executables. For first ssh-keygen support certificates since version "c" (20 Jun 2002). This version introduce regression tests. Later in version "d" (30 Jul 2002) support is added to ssh agent.
    As result PKIX-SSH support certificates as user identity entirely.
  3. Complete support
    Since version "e" (21 Nov 2002) manual pages are updated with information about X.509 certificate support. As well support for certificates as host key in introduced. As version "f" (30 Jan 2003) CRL are supported. Because certificate support is complete as version "f" client prefer algorithms with certificates for host key.
  4. Compatibility
    Compatibility phase begin with version "g" (3 Feb 2003). In version "g1" (30 Apr 2003) regression test scripts are updated to work well with various shells. Since version "g2" (12 Jun 2003) public key algorithm "x509v3-sign-rsa" accept "sha1" signatures in addition to "md5" and now PKIX-SSH is interoperable with all major ssh implementations. This version work fine with OpenSSL 0.9.7+. Later in versions "g3" (25 Feb 2004) and "g4" (9 Maj 2004) code, documentation and regression test are cleaned up.
  5. Validator
    Fifth phase began with OCSP (Online Certificate Status Protocol) support added in version "h" (6 Apr 2004). Later version schema is changed to more common format with numbers N.N{.N} and next version is 5.1. In version 5.3 compatibility is enhanced to support (in addition to [RFC3279] DSA signatures) format defined for "ssh-dss" signature. Self issued certificates can be pertimed by "autorized keys" file since version 5.4 if configuration allow this. Correction for OCSP responder location obtained from certificate is added in version 5.4 and OCSP SSL support is enabled in 5.5.
  6. International
    Since version 6.0 (7 Aug 2007) PKIX-SSH can deal with "distinguished name" stored in autorized keys file as UTF-8 string or escaped. Before to compare printable attributes are converted to utf-8.
  7. Integration
    Starting from version 7.0 (22 Aug 2011) PKIX-SSH can communicate with other applications by using OpenSSL engines. For instance client could use certificates and keys stored in external devices.
    Version 7.1 (15 Jan. 2012) support build with FIPS enabled OpenSSL library and adds direct support of X.509 certificates(RSA) from PKCS11 module. Since this version sha1 is preferred algorithm and programs start to identify as PKIX in comment from ssh identification string.
    Build for android host is supported since version 7.2 (22 Apr. 2012). With version 7.5(19 May 2013) "known hosts" file may contain distinguished name of host X.509 certificate.
  8. Elliptic
    Version 8.0 (11 Aug.2014) is first secure shell implementation that support X.509 ECDSA algorithm as defined in [RFC6187] - initialy for client and server. With version 8.2 (23 Nov. 2014) adds support of X.509 ECDSA algorithm in agent. From version 8.4 (1 Jul 2015) EC keys or X.509 certificates stored on external device could be used with loadable cryptographic modules - OpenSSL engines.
    Support for FIPS environments is enhanced in version 8.1 (29 Sep. 2014) with fipscheck for "Red Hat" FIPS validated environment. Version 8.2 (23 Nov. 2014) is succesfully tested with Solaris 11.2 FIPS validated OpenSSL module.
    Lists with allowed algorithms support patterns since version 8.3 (18 Mart 2015).
    Support for EC keys and certificates stored in PKCS#11 tokens is added in version 8.8 (29 Feb 2016).

News archives:


Recommendet OpenSSL library versions:
Before to use X.509 certificates please read OpenSSL security advisories:
OpenSSL library versions:

[empty image]
[empty image] [empty image] Last modified : Monday May 16, 2016 [empty image]