Feature: SSH Agent – Add support for certificates by AlexpFr · Pull Request #13077 · keepassxreboot/keepassxc

AlexpFr · 2026-02-21T09:38:23Z

SSH Agent – Add support for certificates

This implements the requested feature discussed in issue #5486.

If you have an externally generated OpenSSH certificate file associated with your SSH key, you can configure it in the "Certificate" tab. When the key is loaded, if "Use certificate" is checked, both the key and certificate are added to the agent.

$ ssh-add -l
256 SHA256:cBSn4LZHggKywgcMJPymH3H4GXJyHeo8JDoB2u+7fNo User key (ED25519)
256 SHA256:cBSn4LZHggKywgcMJPymH3H4GXJyHeo8JDoB2u+7fNo User key (ED25519-CERT)

The certificate selection logic strictly mirrors the SSH private key selection logic.

Backward Compatibility

In the KeeAgent.settings file, certificate support has been implemented by adding a separated <LocationCertificate> node with dedicated element names and <UseCertificate> for "Use certificate" checkbox.

Older versions of KeePassXC that do not implement certificate support will ignore these additional XML nodes. Therefore, configuration files containing certificate settings remain fully backward compatible.

Screenshots

Private key tab:

Certificate tab:

Testing strategy

✅ Adding private key only (existing functionality)
✅ Adding private key + certificate from attachment or external file
✅ Switching between attachment/file modes
✅ Adding/removing key to/from agent when database is opened/closed and unlocked/locked
✅ Editing existing entries
✅ Adding/removing attachments dynamically

Quick certificate generation for testing

$ ssh-keygen -f ca_key -C "Certificate Authority"
$ ssh-keygen -f user_key -C "User key"
$ ssh-keygen -s ca_key -I "cert-test-1" -n user user_key.pub

The certificate for user_key is user_key-cert.pub

Type of change

✅ New feature (change that adds functionality)

src/sshagent/KeeAgentSettings.cpp

Copilot

Pull request overview

Adds OpenSSH certificate support to the SSH Agent integration, allowing a configured *-cert.pub to be loaded alongside the private key when an entry is unlocked/opened.

Changes:

Extend KeeAgentSettings and OpenSSHKey to store/load/serialize certificate configuration and data (attachment or external file).
Update the SSH Agent add/remove flows to handle an optional certificate identity.
Update the entry editor UI (new “Certificate” tab), documentation, and translation sources for the new feature.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
src/sshagent/SSHAgent.cpp	Adds agent requests for adding/removing a certificate identity alongside the key.
src/sshagent/OpenSSHKey.h	Adds certificate parsing/writing APIs and storage fields.
src/sshagent/OpenSSHKey.cpp	Implements certificate parsing and binary serialization for agent messages.
src/sshagent/KeeAgentSettings.h	Adds certificate-related settings getters/setters and env substitution.
src/sshagent/KeeAgentSettings.cpp	Adds XML read/write for certificate settings and loads certificate data into `OpenSSHKey`.
src/gui/entry/EditEntryWidgetSSHAgent.ui	Introduces a new “Certificate” tab and related widgets for certificate selection.
src/gui/entry/EditEntryWidget.h	Adds slots/members for certificate UI interaction.
src/gui/entry/EditEntryWidget.cpp	Wires certificate UI controls into settings and key info refresh; adds file browsing for cert.
share/translations/keepassxc_en.ts	Adds new translatable strings for certificate UI and errors.
docs/topics/SSHAgent.adoc	Documents how to associate a certificate with an SSH key in the UI.

You can also share your feedback on Copilot code review. Take the survey.

src/sshagent/SSHAgent.cpp

src/sshagent/OpenSSHKey.cpp

src/gui/entry/EditEntryWidget.cpp

src/gui/entry/EditEntryWidgetSSHAgent.ui

src/sshagent/SSHAgent.cpp

src/sshagent/OpenSSHKey.cpp

src/gui/entry/EditEntryWidgetSSHAgent.ui

src/sshagent/OpenSSHKey.cpp

src/gui/entry/EditEntryWidget.h

varjolintu · 2026-03-08T19:20:31Z

The changes here makes this one obsolete? #13068

- Add #define SSH_MAX_LOCAL_KEY_SIZE (1 MiB) in KeeAgentSettings.h - Replace magic value "1024 * 1024" with this constant

AlexpFr

Yes, this pull request already integrates #13068. I had created it to clearly separate the feature from the bug/improvement.
If the separation is not necessary, we can close #13068.

src/sshagent/KeeAgentSettings.cpp

attachmentCertificateComboBox and attachmentComboBox are already cleared in updateSSHAgentAttachments().

…Certificate

Removed erroneous semicolon

…sage

- Check elements non-empty before accessing first() - Validate minimum 2 elements (type + nonce) - Reject invalid/unsupported certificate types - Verify Base64 nonce decoding success

Move m_addedKeys insertion after key add success but before optional cert add. Ensures keys are always tracked (and auto-removed) even if cert fails.

Validate `stream.writeString(m_certificateType)` success and set m_error on failure, consistent with other write*() calls. Prevents partial stream writes

Avoid sending invalid SSH_AGENTC_REMOVE_IDENTITY to agent when KeePassXC cannot read the certificate data itself. Prevents malformed removal requests for unreadable certificates.

AlexpFr

For unit tests: I haven't written them yet as I'm not comfortable with the test framework yet. Are tests required for this new certificate handling path

src/gui/entry/EditEntryWidget.cpp

src/gui/entry/EditEntryWidget.h

src/sshagent/OpenSSHKey.cpp

src/gui/entry/EditEntryWidgetSSHAgent.ui

src/sshagent/OpenSSHKey.cpp

src/sshagent/SSHAgent.cpp

src/sshagent/OpenSSHKey.cpp

src/sshagent/SSHAgent.cpp

src/gui/entry/EditEntryWidgetSSHAgent.ui

AlexpFr added 4 commits February 18, 2026 14:30

Fix sshAgent casacading calls with QSignalBlocker

e4b0746

SSH Agent: Add support for certificates (keepassxreboot#5486)

5c5d62a

SSH Agent: Add SSH certificate section in documentation

cf0b9e6

SSH Agent: Update keepassxc_en.ts

0cb2caa

droidmonkey added this to the v2.8.0 milestone Mar 8, 2026

droidmonkey added feature: SSH agent pr: new feature Pull request adds a new feature labels Mar 8, 2026

droidmonkey requested review from Copilot, droidmonkey and varjolintu March 8, 2026 19:08

Copilot started reviewing on behalf of droidmonkey March 8, 2026 19:12 View session

varjolintu reviewed Mar 8, 2026

View reviewed changes

src/sshagent/KeeAgentSettings.cpp Outdated Show resolved Hide resolved

varjolintu reviewed Mar 8, 2026

View reviewed changes

src/sshagent/KeeAgentSettings.cpp Outdated Show resolved Hide resolved

varjolintu reviewed Mar 8, 2026

View reviewed changes

src/sshagent/KeeAgentSettings.cpp Outdated Show resolved Hide resolved

Copilot AI reviewed Mar 8, 2026

View reviewed changes

AlexpFr added 2 commits March 9, 2026 11:49

SSH Agent : Use TRUE_STR and FALSE_STR (review)

b7168f6

SSH Agent: use SSH_MAX_LOCAL_KEY_SIZE define for cert+key size checks

3d9ef5c

- Add #define SSH_MAX_LOCAL_KEY_SIZE (1 MiB) in KeeAgentSettings.h - Replace magic value "1024 * 1024" with this constant

AlexpFr commented Mar 9, 2026

View reviewed changes

src/sshagent/KeeAgentSettings.cpp Outdated Show resolved Hide resolved

src/sshagent/KeeAgentSettings.cpp Outdated Show resolved Hide resolved

src/sshagent/KeeAgentSettings.cpp Outdated Show resolved Hide resolved

AlexpFr added 10 commits March 9, 2026 12:40

SSA Agent: remove redundant clear() on attachment combo boxes

7916050

attachmentCertificateComboBox and attachmentComboBox are already cleared in updateSSHAgentAttachments().

SSH Agent: Remove unused members m_entryCertificate and m_attachments…

808ced6

…Certificate

SSH Agent: fix QString concatenation syntax error in error message

a4f5347

Removed erroneous semicolon

SSH agent: oops - fix QString concatenation syntax error in error mes…

5831029

…sage

SSH Agent: Replace QString::SkipEmptyParts with Qt::SkipEmptyParts

94428b4

SSH Agent: Fix accessibleName for externalCertificateFileEdit

82f6d3a

SSH Agent: Improve OpenSSH certificate validation

94ef870

- Check elements non-empty before accessing first() - Validate minimum 2 elements (type + nonce) - Reject invalid/unsupported certificate types - Verify Base64 nonce decoding success

SSH Agent: Track keys immediately after successful add

963bbd0

Move m_addedKeys insertion after key add success but before optional cert add. Ensures keys are always tracked (and auto-removed) even if cert fails.

SSH Agent: Check writeString() return value in OpenSSHKey

3f497f2

Validate `stream.writeString(m_certificateType)` success and set m_error on failure, consistent with other write*() calls. Prevents partial stream writes

SSH Agent: Skip cert removal if writeCertificate() fails

fb0b003

Avoid sending invalid SSH_AGENTC_REMOVE_IDENTITY to agent when KeePassXC cannot read the certificate data itself. Prevents malformed removal requests for unreadable certificates.

AlexpFr commented Mar 9, 2026

View reviewed changes

Uh oh!

Conversation

AlexpFr commented Feb 21, 2026

SSH Agent – Add support for certificates

Backward Compatibility

Screenshots

Testing strategy

Quick certificate generation for testing

Type of change

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

varjolintu commented Mar 8, 2026

Uh oh!

AlexpFr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AlexpFr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants