Our SSH certificates are in OpenSSH format (RFC 4253), not X.509. These use a custom binary encoding that SecCertificate doesn't understand.
Since kSecClassCertificate expects X.509 DER format:
Should we store OpenSSH certificates as kSecClassGenericPassword with descriptive metadata?
Is there any Keychain support for non-X.509 certificate formats?
Or is the recommendation to keep them as files and only move X.509 TLS certs to Keychain?
Example OpenSSH Certificate (text format):
ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQt...
Our current thinking is to store these as generic passwords:
let query: [String: Any] = [
kSecClass: kSecClassGenericPassword,
kSecAttrService: "com.teleport.ssh.cert",
kSecAttrAccount: "\(cluster).\(user)",
kSecAttrLabel: "Teleport SSH Certificate",
kSecValueData: sshCertData,
kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
]
Is this an acceptable approach for non-X.509 certificates?