I'm trying to use SSH using signed certificates.  I'm using ssh -i keys/client.key to connect to the target device.  If I generate a public key from that private key (with ssh-keygen -y -f keys/client.key) and place that in the .ssh/authorized_keys file I'm able to connect with no issue.What I'm trying to do is use the CA to allow all keys signed by that CA to log in as that user.  I used  ssh-keygen -y -f keys/ca.key to generate a public key and put it into authorized_keys as cert-authority sh-rsa AAAB3N.....Z.  My understanding from different sites is that it should now work, except that it doesn't.  On the client side I just get Permission denied (publickey)..  I have no other listings in the authorized_keys file.  On the server side I don't get any error message and only a message that the client disconnected.Am I missing something simple?  How can I debug why it's not working.Edit #1I generated the private keys with EasyRSA which is some shell scripts over openssl calls.  I think the issue may be that the private key was generated, then a CSR, then a signed certificate.  Therefore, I don't think the private key is signed in any sort of fashion.Edit #2I tried ssh-keygen -s ca.key -I key client.key and I get 'do_ca_sign: unable to open client.key'.  I tried it with a freshly generated RSA key made by ssh-keygen and it worked fine so the ca.key seems to be okay.  I'm thinking there's something about the openssl generated private key that it doesn't like.
SSH via cert-authority
ssh;openssl;openssh;sshd