===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh_config.5,v
retrieving revision 1.281
retrieving revision 1.282
diff -u -r1.281 -r1.282
--- src/usr.bin/ssh/ssh_config.5	2018/07/23 19:02:49	1.281
+++ src/usr.bin/ssh/ssh_config.5	2018/09/20 03:30:44	1.282
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.281 2018/07/23 19:02:49 kn Exp $
-.Dd $Mdocdate: July 23 2018 $
+.\" $OpenBSD: ssh_config.5,v 1.282 2018/09/20 03:30:44 djm Exp $
+.Dd $Mdocdate: September 20 2018 $
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -261,6 +261,18 @@
 .It Cm BindInterface
 Use the address of the specified interface on the local machine as the
 source address of the connection.
+.It Cm CASignatureAlgorithms
+Specifies which algorithms are allowed for signing of certificates
+by certificate authorities (CAs).
+The default is:
+.Bd -literal -offset indent
+ecdsa-sha2-nistp256.ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
+.Ed
+.Pp
+.Xr ssh 1
+will not accept host certificates signed using algorithms other than those
+specified.
 .It Cm CanonicalDomains
 When
 .Cm CanonicalizeHostname