Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Overview of the Issue

I'm not sure if this is an issue with packer or with the proxmox plugin, but it seems that there is a bug when ssh_certificate_file is specified for the build image at the same time as using a bastion host with no ssh_bastion_certificate_file.

In this case the ssh bastion key is wrongly signed with ssh_certificate_file :

* ssh_bastion_private_key_file is invalid: failed to create cert signer: ssh: signer and cert have different public key

I tried explicitly setting ssh_bastion_certificate_file to null but I get the same behaviour.

The only workaround I found was to configure an ssh CA cert on the bastion host and create a cert for the bastion key with that CA.

Packer version

• packer v1.8.6
• github.com/hashicorp/proxmox 1.1.2

Simplified Packer Template

source "proxmox-clone" "vm" {
  clone_vm = "my_image"
  ...
  ssh_username = "root"
  ssh_private_key_file = "./deploy.key"
  ssh_certificate_file = "./deploy.key-cert.pub"
  ssh_bastion_username = "packer"
  ssh_bastion_host = "bastion"
  ssh_bastion_private_key_file = "bastion.key"
  ssh_bastion_certificate_file = null
}

Log Fragments and crash.log files

* ssh_bastion_private_key_file is invalid: failed to create cert signer: ssh: signer and cert have different public key