[ssh_x509] X509v3 RSA hostkey support

[ssh_x509 at roumenpetrov.info]

Hi,

I am looking for understanding how to configure the SSH Server with x509v3
hostkey support. I have an RSA based private key and certificate both in
PEM format. From readme.x509v3 I see the below:

(snip)

How to use X.509 certificates with SSH?Identity or hostkey file
contain private key and may contain X.509certificate that match it.
Note that key and X.509 certificate has tobe in PEM format. To use
X.509 certificate as identity or hostkey usershould convert
certificate in PEM format and append to file. After thiswith
"ssh-keygen -y ..." user must update "pub" file.File (identity or
hostkey) with X.509 certificate (PKCS#8 key format):-----BEGIN PRIVATE
KEY-----.....-----END PRIVATE KEY----------BEGIN
CERTIFICATE-----.....-----END CERTIFICATE-----


(snip)

My understanding is - its enough to have a single hostkey file - where I
can append RSA private key PEM content and RSA certificate PEM content.
Then configure that file as a HostKey file.

Query 1:

I could not understand the part "After this with ssh-keygen user must
update the pub file". Is this step really needed ? Since we can specify
both private PEM key and public PEM certificate in a single file - what is
the necessity for this ssh-keygen - and .pub file ? Can I skip this step ?

Query 2:

If I have only a single file which has both private key and certificate -
then how will the public key load be handled during server startup ?

Thanks in advance.

Thanks,
Murugesh