SSH key not found on system with TPM enabled config

[allgeyer]

I've successfully managed to get step ca docker image running with a vTPM device. Issuing X.509 certificates is working. Now I wanted to add a SSH provider to my configuration. I created the Host/User Keys with ssh crypto keypair <pubkey> <secretkey> and added the ssh section to ca.json as following:

       "ssh": {
                "hostKey": "/home/step/secrets/ssh_host_ca_key",
                "userKey": "/home/step/secrets/ssh_user_ca_key"
        },

After restarting the docker container, I get this error:

step-ca  | Using host pcscd (socket detected at /var/run/pcscd/pcscd.comm)
step-ca  | failed getting key "/home/step/secrets/ssh_host_ca_key": not found
step-ca exited with code 2 (restarting)
step-ca  | Using host pcscd (socket detected at /var/run/pcscd/pcscd.comm)
step-ca  | failed getting key "/home/step/secrets/ssh_host_ca_key": not found
step-ca exited with code 2 (restarting)
step-ca  | Using host pcscd (socket detected at /var/run/pcscd/pcscd.comm)

Not sure what it is. Verified the correct password-file contents, tried to regenerate keys w/o a password, made sure file exists and is readable. Nothing helped. Maybe a simple configuration thing or does step-ca search the keys for SSH via pcscd in the TPM keystore?

[allgeyer]

To answer myself:

If using a TPM device, you'll have to create SSH keys with step kms create:

step@bf66bfd9f9fb:~$ step kms create --json --kms 'tpmkms:name=step-intermediate-ca' ssh-user-ca
{
  "name": "tpmkms:name=ssh-user-ca",
  "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0pcmzLKF5+VjDdjklRqcX6vOf6KR\nfAQdn2sc8SJUneMCsUovlpLiHlPOahrBT3t+G6qO0R1Xjj0caHzNK3RLxg==\n-----END PUBLIC KEY-----\n"
}
step@bf66bfd9f9fb:~$ step kms create --json --kms 'tpmkms:name=step-intermediate-ca' ssh-host-ca
{
  "name": "tpmkms:name=ssh-host-ca",
  "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfvMj6Tzpw3Ncw4pmhHutsaeyyS3G\nw2BGTk9vfvNnEweIYY9mDp4DXfOY4t2DPZtX3py1/sxTDGctEcWIB7sbSA==\n-----END PUBLIC KEY-----\n"

Afterwards add this section to ca.json:

  "ssh": {
    "hostKey": "tpmkms:name=ssh-host-ca",
    "userKey": "tpmkms:name=ssh-user-ca"
  },

Restarting step-ca, you will get an output similar to this one:

step-ca  | 2026/05/19 06:19:27 X.509 Root Fingerprint: 5d259f4d892cf37853982ad40058c44690f966cb19c1f5f37351967f8fc194a4
step-ca  | 2026/05/19 06:19:27 SSH Host CA Key: ecdsa-sha2-nistp256 AAAAE2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
step-ca  | 2026/05/19 06:19:27 SSH User CA Key: ecdsa-sha2-nistp256 AAAAE2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=

Please be aware that Smallstep does not currently support using Ed25519 private keys for the SSH CA mechanism. RSA or ECDSA (like NIST P-256) keys must be used for SSH User and Host CA operations. Not really satisfying.