macOS bundled OpenSSH_9.4p1 ssh-add doesn't support ecdsa-sha2-nistp256-cert-v01@openssh.com

This is not a public key but an ECDSA certificate....

This certificate is intended to be offered to a server as shown below.

debug1: Offering public key: /Users/serhan/.cloudflared/access.serhanekici.com-cf_key-cert.pub ECDSA-CERT SHA256:vGpMXvU6hjIKTRJBRJIckcuVDtTrhVpx1ixfUUaP4h0 explicit
debug1: Server accepts key: /Users/serhan/.cloudflared/access.serhanekici.com-cf_key-cert.pub ECDSA-CERT SHA256:vGpMXvU6hjIKTRJBRJIckcuVDtTrhVpx1ixfUUaP4h0 explicit

However, macOS bundled OpenSSH `ssh-add` complaining about the certificate format. Therefore, I cannot add this certificate to my `ssh-agent`. As a result, certificate is not getting forwarded when using the `ForwardAgent yes` option or the `-a` flag which means I can use it only once. I could forward this cert to my bastion host and offer it to other servers as well if `ssh-add` would support the certificate format.

I figured it out though, leaving here if you anyone come across this as well:

Cert is not added manually (which is a very bad design choice) it is only added when you add it's key. Problem is, it was not getting added to ssh-agent automatically for some reason even when `ForwardAgent` is set. This is probably a lack of feature in OpenSSH itself.

~
serhan@pc001 ❯ ssh-add .cloudflared/access.serhanekici.com-cf_key
Identity added: .cloudflared/access.serhanekici.com-cf_key (.cloudflared/access.serhanekici.com-cf_key)
Certificate added: .cloudflared/access.serhanekici.com-cf_key-cert.pub (eceebdc019f3a062186d289fe31b54f4)

This did the trick, can be configured in config as below too.

Match host access.serhanekici.com exec "cloudflared access ssh-gen --hostname %h && ssh-add ~/.cloudflared/%h-cf_key"