title: Why ssh-agent doesn't forward my SSH certificate?
body: <blockquote>
    <p>This thread is a response to the titled question : <strong>Why ssh-agent doesn't forward my SSH certificate ?</strong>
    Actually I couldn't find any information during my search. I had to <a href="https://github.com/openssh/openssh-portable/blob/22376d27a349f62c502fec3396dfe0fdcb2a40b7/ssh-add.c" rel="nofollow noreferrer">read the C code of ssh-add</a>
    to resolve my issue.. </p>
  </blockquote>
  
  <h2>Problem</h2>
  
  <p>I got a valid SSH Certificate :</p>
  
  <pre><code>$ ssh-keygen -L -f ~/.ssh/id_rsa-cert.pub 
  /home/user/.ssh/id_rsa-cert.pub:
      Type: ssh-rsa-cert-v01@openssh.com user certificate
      Public key: RSA-CERT SHA256:YgFzKPkUdZHLLi8bEKUs5/hLumNoMNG+oDJ+KD6mS3s
      Signing CA: RSA SHA256:w+Cjpu/QQUunuojs9Af82ENdBUreCDXo+APao9X4dHw
      Key ID: "user_key"
      Serial: 0
      Valid: from 2017-12-06T10:53:00 to 2017-12-07T10:54:57
      Principals: 
              user
              admin
      Critical Options: (none)
      Extensions: 
              permit-X11-forwarding
              permit-agent-forwarding
              permit-port-forwarding
              permit-pty
              permit-user-rc
  </code></pre>
  
  <p>This is my ssh-agent list of keys :</p>
  
  <pre><code>$ ssh-add -l
  4096 SHA256:YgFzKPkUdAGBPi8bEKUs5/hLumNoAds+oDJ+KD6mS3s user_key (RSA)
  </code></pre>
  
  <p>When I SSH on a remote server, it works. I have no <code>~/.ssh/authorized_keys</code> and my key is probably well forwarded because I got the same previous result. </p>
  
  <p>Now I would like to SSH to another server from the first one (with <code>ForwardAgent yes</code>):</p>
  
  <pre><code>$ ssh srv1
  srv1:~$ ssh srv2 -vvv
  ...
  debug3: authmethod_is_enabled publickey
  debug1: Next authentication method: publickey
  debug1: Offering RSA public key: user_key
  debug3: send_pubkey_test
  debug2: we sent a publickey packet, wait for reply
  ...
  Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
  srv1:~$ 
  </code></pre>
  
  <p>What did I do wrong ?</p>