How to connect Unix VM with privateKey and Microsoft Entra ID certificate

Question

We are currently trying to establish an SSH connection to an Azure Linux VM using a Microsoft Entra ID user account. The existing approach, as documented by Microsoft, uses an OpenSSH certificate-based authentication mechanism.

The prerequisites and current process are as follows:

1. Generate an RSA key pair
   Generate the RSA private and public key pair required for SSH authentication.

2. Authenticate to Microsoft Entra ID
   Sign in to Azure using the Microsoft Entra ID credentials:
   az login --username "EntraIDUsername" --password "EntraIDPassword"

3. Generate the Microsoft Entra ID–signed SSH certificate
   Use the Azure CLI SSH extension to generate the short-lived SSH certificate:
   az ssh cert --public-key-file "PublicKeyPath" --file "OutputCertificatePath"

4. Use the private key and Microsoft Entra ID–signed certificate
   The generated private key and certificate are then used to establish an SSH session with the target Azure VM.

5. Connect using PuTTY
   The generated certificate and corresponding private key can be used with an SSH client such as PuTTY, provided the client supports OpenSSH certificate-based authentication.

We would like to implement the same authentication flow using the Rebex SSH client/library instead of PuTTY/OpenSSH
Specifically, we would like to understand:
Does the current version of Rebex SSH support authentication using an OpenSSH user certificate of type ssh-rsa-cert-v01@openssh.com?
If supported, could you provide an example or recommended implementation for:
Loading the RSA private key.
Loading/associating the Microsoft Entra ID–issued OpenSSH certificate.
Using the certificate and private key to authenticate to the Azure VM.

Answer 1

Support for OpenSSH user certs such as ssh-rsa-cert-v01@openssh.com is currently experimental and can be performed like this:

using Rebex.Net;
using Rebex.Security.Cryptography;
...

// load proprietary OpenSSH certificate into SshPublicKey
var publicCert = new SshPublicKey("user01-opensshcert.pub");

// load OpenSSH certificate's private key into SshPrivateKey
var privateKey = new SshPrivateKey("user01.pri", password);

// associate the certificate with the private key
CryptoHelper.SetOption(privateKey, "OpenSshCert", publicCert);

// connect to a server using the key with associated cert
var sftp = new Sftp();

// enable experimental OpenSSH certificate support
CryptoHelper.SetOption(sftp.Settings.SshParameters, "EnableOpenSshCerts", true);

// register server key check handler
sftp.FingerprintCheck += MyServerKeyCheck;

// connect to a server
sftp.Connect("server01");

// authenticate using OpenSSH user cert
sftp.Login("user01", privateKey);
...

---

Additional information, mostly for context:

Historically, Rebex SFTP has supported the standard X.509 certificates, as specified by IETF RFC 6187. These use types x509v3-rsa2048-sha256 for RSA certificates and ecdsa-sha2-* for ECDSA certificates, and uses the same certificates as HTTP and other common protocols.

But strangely, it looks like Microsoft instead chose to use the proprietary OpenSSH certificates for Entra ID. These are not compatible with standard X.509 certificates and not endorsed by IETF. Rebex recommends using standard X.509 certificates whenever possible.