{"id":"44824c48b7627685","repo":"rust-lang/cargo","slug":"error-found-a-cert-authority-marker-for-host","errorCode":null,"errorMessage":"error: Found a `@cert-authority` marker for `{hostname}`\n\nCargo doesn't support certificate authorities for host key verification. It is\nrecommended that the command line Git client is used instead. This can be achieved\nby setting `net.git-fetch-with-cli` to `true` in the Cargo config.\n\nThe `@cert-authority` line was found in {location}.\n\nSee https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts for more information.\n","messagePattern":"error: Found a `@cert-authority` marker for `(.+?)`\n\nCargo doesn't support certificate authorities for host key verification\\. It is\nrecommended that the command line Git client is used instead\\. This can be achieved\nby setting `net\\.git-fetch-with-cli` to `true` in the Cargo config\\.\n\nThe `@cert-authority` line was found in (.+?)\\.\n\nSee https://doc\\.rust-lang\\.org/stable/cargo/appendix/git-authentication\\.html#ssh-known-hosts for more information\\.\n","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/sources/git/known_hosts.rs","lineNumber":312,"sourceCode":"            remote_host_key,\n            location,\n        }) => {\n            let key_type_short_name = key_type.short_name();\n            anyhow::bail!(\n                \"error: Key has been revoked for `{hostname}`\\n\\\n                **************************************\\n\\\n                * WARNING: REVOKED HOST KEY DETECTED *\\n\\\n                **************************************\\n\\\n                This may indicate that the key provided by this host has been\\n\\\n                compromised and should not be accepted.\n                \\n\\\n                The host key {key_type_short_name} {remote_host_key} is revoked\\n\\\n                in {location} and has been rejected.\\n\\\n                \"\n            )\n        }\n        Err(KnownHostError::HostHasOnlyCertAuthority { hostname, location }) => {\n            anyhow::bail!(\"error: Found a `@cert-authority` marker for `{hostname}`\\n\\\n                \\n\\\n                Cargo doesn't support certificate authorities for host key verification. It is\\n\\\n                recommended that the command line Git client is used instead. This can be achieved\\n\\\n                by setting `net.git-fetch-with-cli` to `true` in the Cargo config.\\n\\\n                \\n\n                The `@cert-authority` line was found in {location}.\\n\\\n                \\n\\\n                See https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts \\\n                for more information.\\n\\\n                \")\n        }\n    }\n}\n\n/// Checks if the given host/host key pair is known.\nfn check_ssh_known_hosts(\n    gctx: &GlobalContext,\n    cert_host_key: &git2::cert::CertHostkey<'_>,","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/sources/git/known_hosts.rs#L294-L330","documentation":"The `HostHasOnlyCertAuthority` variant: a known_hosts source contains a `@cert-authority` line for the host. Cargo/libgit2's SSH host-key verification does not support SSH certificate authorities — it matches literal host keys only. Cargo refuses and points the user at the system git CLI, which does support cert-based verification.","triggerScenarios":"An SSH setup that relies on certificate-authority-signed host keys (common in large orgs with centralized SSH CA), where `~/.ssh/known_hosts` has a `@cert-authority <host> <ca-key>` line and no literal host key for that host. Cargo's `check_ssh_known_hosts` returns the cert-authority variant.","commonSituations":"Corporate/enterprise environments using SSH CAs (e.g. Netflix, Facebook-style centralized SSH); Vault-signed SSH; netflix/security-tooling managed known_hosts; connecting to internal git infra that only publishes CA-signed host keys.","solutions":["Set `net.git-fetch-with-cli = true` in `.cargo/config.toml` so Cargo shells out to the system `git`, which honors `@cert-authority`.","Ensure the system `ssh`/`git` and `~/.ssh/known_hosts` are configured with the CA for the host.","Alternatively, add a literal (non-CA) host key for the host to known_hosts, if the server provides one."],"exampleFix":"# before: cargo rejects @cert-authority\n# after (.cargo/config.toml)\n[net]\ngit-fetch-with-cli = true","handlingStrategy":"fallback","validationCode":"# If SSH CA is required, enable git-fetch-with-cli in .cargo/config.toml:\ncat > .cargo/config.toml <<'EOF'\n[net]\ngit-fetch-with-cli = true\nEOF\n# Verify the system git can resolve the host via the CA:\nGIT_SSH_COMMAND=\"ssh -v\" git ls-remote <git-dep-url>","typeGuard":null,"tryCatchPattern":null,"preventionTips":["In enterprise environments using SSH CAs, always set `net.git-fetch-with-cli = true`.","Commit this Cargo config so all team members and CI use the system git for SSH.","Keep the system `ssh` config and CA trust anchors up to date."],"tags":["ssh","git","cert-authority","security","enterprise","config"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}