rust-lang/cargo · error · anyhow::Error

error: Found a `@cert-authority` marker for `{hostname}` Ca

Error message

error: Found a `@cert-authority` marker for `{hostname}`

Cargo doesn't support certificate authorities for host key verification. It is
recommended that the command line Git client is used instead. This can be achieved
by setting `net.git-fetch-with-cli` to `true` in the Cargo config.

The `@cert-authority` line was found in {location}.

See https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts for more information.

What it means

The `HostHasOnlyCertAuthority` variant: a known_hosts source contains a `@cert-authority` line for the host. Cargo/libgit2's SSH host-key verification does not support SSH certificate authorities — it matches literal host keys only. Cargo refuses and points the user at the system git CLI, which does support cert-based verification.

Source

Thrown at src/sources/git/known_hosts.rs:312

            remote_host_key,
            location,
        }) => {
            let key_type_short_name = key_type.short_name();
            anyhow::bail!(
                "error: Key has been revoked for `{hostname}`\n\
                **************************************\n\
                * WARNING: REVOKED HOST KEY DETECTED *\n\
                **************************************\n\
                This may indicate that the key provided by this host has been\n\
                compromised and should not be accepted.
                \n\
                The host key {key_type_short_name} {remote_host_key} is revoked\n\
                in {location} and has been rejected.\n\
                "
            )
        }
        Err(KnownHostError::HostHasOnlyCertAuthority { hostname, location }) => {
            anyhow::bail!("error: Found a `@cert-authority` marker for `{hostname}`\n\
                \n\
                Cargo doesn't support certificate authorities for host key verification. It is\n\
                recommended that the command line Git client is used instead. This can be achieved\n\
                by setting `net.git-fetch-with-cli` to `true` in the Cargo config.\n\
                \n
                The `@cert-authority` line was found in {location}.\n\
                \n\
                See https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts \
                for more information.\n\
                ")
        }
    }
}

/// Checks if the given host/host key pair is known.
fn check_ssh_known_hosts(
    gctx: &GlobalContext,
    cert_host_key: &git2::cert::CertHostkey<'_>,

View on GitHub (pinned to 0e07a15537)

Solutions

Set `net.git-fetch-with-cli = true` in `.cargo/config.toml` so Cargo shells out to the system `git`, which honors `@cert-authority`.
Ensure the system `ssh`/`git` and `~/.ssh/known_hosts` are configured with the CA for the host.
Alternatively, add a literal (non-CA) host key for the host to known_hosts, if the server provides one.

Example fix

# before: cargo rejects @cert-authority
# after (.cargo/config.toml)
[net]
git-fetch-with-cli = true

Defensive patterns

Strategy: fallback

Validate before calling

# If SSH CA is required, enable git-fetch-with-cli in .cargo/config.toml:
cat > .cargo/config.toml <<'EOF'
[net]
git-fetch-with-cli = true
EOF
# Verify the system git can resolve the host via the CA:
GIT_SSH_COMMAND="ssh -v" git ls-remote <git-dep-url>

Prevention

In enterprise environments using SSH CAs, always set `net.git-fetch-with-cli = true`.
Commit this Cargo config so all team members and CI use the system git for SSH.
Keep the system `ssh` config and CA trust anchors up to date.

When it happens

Trigger: An SSH setup that relies on certificate-authority-signed host keys (common in large orgs with centralized SSH CA), where `~/.ssh/known_hosts` has a `@cert-authority <host> <ca-key>` line and no literal host key for that host. Cargo's `check_ssh_known_hosts` returns the cert-authority variant.

Common situations: Corporate/enterprise environments using SSH CAs (e.g. Netflix, Facebook-style centralized SSH); Vault-signed SSH; netflix/security-tooling managed known_hosts; connecting to internal git infra that only publishes CA-signed host keys.

Related errors

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/44824c48b7627685.json. Report an issue: GitHub.