Okta Advanced Server Access SSH Fails With Certificate Invalid Error
Last Updated:
Overview
Okta generates a certificate invalid error when attempting to authenticate to a Linux server via Secure Shell (SSH) in Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) due to server clock drift. Resolve this issue by correcting the server time and configuring the Network Time Protocol (NTP). When attempting to SSH to a Linux server, the login fails with the following client error:
error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535
The SSH daemon (SSHD) logs on the server display the following errors:
Mar 22 03:11:10 testserver02 sshd[22509]: error: key_cert_check_authority: invalid certificate
Mar 22 03:11:10 testserver02 sshd[22509]: error: Certificate invalid: expired
Mar 22 03:11:10 testserver02 sshd[22509]: Connection closed by 10.63.77.202 port 57689 [preauth]
OR
Mar 23 09:37:12 testserver01 sshd[1634]: error: Certificate invalid: not yet valid
Mar 23 09:37:12 testserver01 sshd[1634]: Connection closed by authenticating user test_user 10.63.77.201 port 50937 [preauth]
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Advanced Server Access (ASA)
- Okta Privileged Access (OPA)
- Secure Shell (SSH)
Cause
The error occurs because the server clock has drifted. Okta Advanced Server Access (ASA) dynamically issues short-lived certificates for client authentication with a limited validity window. If the server clock is incorrect, the server identifies the certificate from ASA as expired or not yet valid, causing the SSH daemon (SSHD) to reject the access attempt.
Solution
How is the certificate invalid error resolved?
Correct the time on the server and configure the Network Time Protocol (NTP) to prevent future clock drift.
- Correct the time on the server. Consult with the server administrator for specific instructions, as the process varies between servers.
- Configure the Network Time Protocol (NTP) on the server to avoid future clock drift.
