hi,I am interested in this issue and would like to work on it.
If there are any relevant code references or examples, please let me know.

https://github.com/vyos/vyos-1x/pull/4234
Development has begun! :)

I’ve made various improvements to the code based on the feedback from the review and have moved things forward.
Could you let me know how I can proceed to get further reviews on this PR? 😊

Hi.
The CLI smoketests are failing due to changes unrelated to this PR. I checked the "current" branch and found that the same issue occurs there as well, so it seems that it cannot be resolved unless it is addressed separately.
I believe there are no issues with this PR itself, so I would like it to be merged. What do you think?
I have already received a review and approval.

Thank you for merging the PR! I plan to work on the AuthorizedPrincipalsFile support next. I look forward to your continued support:)

I have added what you included this time to the documentation. It's a simple update, but please review it.

https://github.com/vyos/vyos-documentation/pull/1578

Hello @takehaya,

Thank you for the feature; I really appreciate it.

I'm having trouble making it work and would gladly accept any assistance. From what I understand, the procedure is as follows:

1. Add a certificate authority using the PKI module: `bash set pki ca <ca_name> certificate `
2. Reference the CA in the SSH service: `bash set service ssh trusted-user-ca-key ca-certificate <ca_name> `

The issue I'm facing is that my SSH CA public key is in the .pub format (ssh-rsa AAAAB3...), which is standard for SSH, rather than the .pem format (-----BEGIN [something]-----) required by VyOS PKI.

I tried converting the .pub key to .pem, but I encountered the following error:

[pki]  
Invalid certificate on CA certificate "vault"  
[[pki]] failed  

[service ssh]  
Traceback (most recent call last):  
  File "/usr/libexec/vyos/services/vyos-configd", line 138, in run_script  
    script.generate(c)  
  File "/usr/libexec/vyos/conf_mode/service_ssh.py", line 133, in generate  
    ca_full_chain = find_chain(loaded_ca_cert, loaded_ca_certs)  
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^  
  File "/usr/lib/python3/dist-packages/vyos/pki.py", line 451, in find_chain  
    parent = find_parent(chain[-1], remaining)  
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^  
  File "/usr/lib/python3/dist-packages/vyos/pki.py", line 442, in find_parent  
    if verify_certificate(cert, ca_cert):  
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^  
  File "/usr/lib/python3/dist-packages/vyos/pki.py", line 363, in verify_certificate  
    if ca_cert.subject != cert.issuer:  
       ^^^^^^^^^^^^^^^  
AttributeError: 'bool' object has no attribute 'subject'  

[[service ssh]] failed  
Commit failed

For additional context, I am using Vault’s SSH secret engine for fully automated credential management.

@tarik.haddouchi I just merged the changes into current and thus will be in the next rolling release. I also encountered this weirdness. CA keys have been moved to OpenSSH public/private keys, see updated documentation: https://docs.vyos.io/en/latest/configuration/service/ssh.html