# Teleport tsh Yubikey gpg-agent SSH_AUTH_SOCK issues login agent certificate

## The problem

When gpg-agent is running (used by Yubikeys to hold keys), `tsh` adds SSH certificates to the agent, which gpg-agent does not understand (gpg-agent does not support SSH certificates). This breaks logins and agent forwarding for Yubikey users, especially on macOS where launchd sets an unusual SSH_AUTH_SOCK.

## The verified fix

Point SSH_AUTH_SOCK at the gpg-agent SSH socket explicitly instead of the launchd-provided one: add `export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)` to your shell rc file (this resolves to ~/.gnupg/S.gpg-agent.ssh). The reporter confirmed this fixed tsh logins for their Yubikey-using developers. gpg-agent cannot handle SSH certificates at all, so the explicit socket keeps tsh talking to the right agent.

Source: https://github.com/gravitational/teleport/issues/3169