Add support for SSH certificates

[TimWolla]

see mscdex/ssh2#808

The biggest issue when debugging this was was that the code unconditionally used the key type as the signature type. For SSH certificates these do not match up. Apart from that the code already handled certificates well.

[TimWolla]

@mscdex Did you have time to take a look, yet?

[dsafanyuk]

Would love to have this merged! Using @TimWolla's changes works great in our tests.

[jisack]

looking forward for this PR is merged.

[aadityabhatia]

Tested it -- works as expected with [email protected] and [email protected] user certificates. Anything I could do to help move this along?

[auphofBSF]

I am trying to use this for SSH Certificate Authority authentication using Hashicorp VAULT SSH CA. I have the appropriate VAULT SSH CA key on the OpenSSH configured as in sshd_config
TrustedUserCAKeys.

On the client side I have a private key id_rsa_<user> and valid Vault SSH CA signed certificate id_rsa_<user>-cert.pub that i have attempted to use as the public_key in this ssh2 branch.

Note: This works perfectly from an openssh client in bash ssh -i id_rsa_<user> <user>@<server>

However I am unable to make work using this branch of SSH2. I am testing with the modified SSH2 example https://github.com/mscdex/ssh2#execute-uptime-on-a-server

I get the error: Error('publicKey does not belong to the private key')

Thank you for your work in this PR

var Client = require('ssh2').Client;

var conn = new Client();
conn.on('ready', function() {
  console.log('Client :: ready');
  conn.exec('uptime', function(err, stream) {
    if (err) throw err;
    stream.on('close', function(code, signal) {
      console.log('Stream :: close :: code: ' + code + ', signal: ' + signal);
      conn.end();
    }).on('data', function(data) {
      console.log('STDOUT: ' + data);
    }).stderr.on('data', function(data) {
      console.log('STDERR: ' + data);
    });
  });
}).connect({
    host: '<server>',
    port: 22,
    username: '<user>',
    privateKey: require('fs').readFileSync('<full_path>/id_rsa_<user>'),
    publicKey: require('fs').readFileSync('<full_path>/id_rsa_<user>-cert.pub')
  });

[dhensby]

I'd suggest this entire switch statement is unnecessary and you could just perform the replace blind. But this particular case statement seems redundant as it doesn't end in the appropriate string to qualify for the replace call?

[TimWolla]

In fact the two cases below are also identical. These should've been [email protected], [email protected], and [email protected].

Not going to fix it, because this PR realistically is not going to be merged due to the planned rewrite of this library.

[GitMensch]

Not going to fix it, because this PR realistically is not going to be merged due to the planned rewrite of this library.

Are this issues the same in mscdex/ssh2#808 (which also "primarily awaits an updated PR")?