SSH certificate authentication is configured, but the principals file permissions are too open and the daemon ignores it for security reasons

The CA trust path is valid, yet certificate login falls back to password prompts because the principal mapping file fails ownership checks.