# TL server/agent sshkeys signed by CA

**URL:** <https://community.thinlinc.com/t/tl-server-agent-sshkeys-signed-by-ca/1125>\
**Category:** Community Support\
**Tags:** tlclient\
**Created:** [7 October 2024 13:18 UTC](https://community.thinlinc.com/t/tl-server-agent-sshkeys-signed-by-ca/1125 "2024-10-07T13:18:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jubork](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jubork](https://community.thinlinc.com/u/jubork)\
**Post date:** [7 October 2024 13:18 UTC](https://community.thinlinc.com/t/tl-server-agent-sshkeys-signed-by-ca/1125/1 "2024-10-07T13:18:40Z")

</div>

Hi,

tlclient (tested only with current linux version) does seem  
to ignore any CA keys in /opt/thinlinc/etc/ssh\_known\_hosts added via, i.e :

echo ` "@cert-authority *.example.com $(cat /etc/ssh/ca.pub)" >>/opt/thinlinc/etc/ssh_known_hosts`

In my use case, all hosts running TL software have their sshkeys signed by a CA.  
I propose to implement support for ssh keys signed by a CA. Specifically,  
if CA sshpubkey is in /opt/thinlinc/etc/ssh\_known\_hosts tlclient should happily  
accept any (barring CRL) ssh key signed by it without warning user about unknown authenticity/fingerprint.

---

<div class="post-metadata">

**Author:** ![aaron](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/aaron/32/13_2.png) [@aaron](https://community.thinlinc.com/u/aaron)\
**Post date:** [7 October 2024 23:10 UTC](https://community.thinlinc.com/t/tl-server-agent-sshkeys-signed-by-ca/1125/2 "2024-10-07T23:10:39Z")

</div>

Hi @jubork

Welcome to the forum.

This feature is being tracked in our Bugzilla as #7641:

[https://bugzilla.cendio.com/show\_bug.cgi?id=7641](https://bugzilla.cendio.com/show_bug.cgi?id=7641)

Please feel free to subscirbe to this bug for updates, your interest in this feature has been noted.

Are you able to tell us a little bit more about your use case, and the background behind this requirement?