Using the `step` CLI you can see which principals exist on a host certificate.
The quickest way to view a host certificate is as follows
# Manual command will show you the identity to reference (reference)
step ssh list
#Show the encrypted cert and identity (roughly the same as `ssh-add -L`)
step ssh list --raw
# Option 1: Copy the encrypted cert string and reference/pipe it to the following:
step ssh inspect [encrypted cert string]
# Option 2: everything in one command. NC==1 returns the first key in the array.
step ssh list $(ssh-add -L | awk '{print $3} NC==1') --raw | step ssh inspect
For more information on `step ssh` commands, see our command reference here.