--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -390,6 +390,10 @@ check_principals_line(struct ssh *ssh, c
 			continue;
 		debug3("%s: matched principal \"%.100s\"",
 		    loc, cert->principals[i]);
+		verbose("Matched principal \"%.100s\" from %s against \"%.100s\" "
+		    "from cert",
+		    cp, loc, cert->principals[i]);
+
 		found = 1;
 		slog_set_principal(cp);
 	}
@@ -433,6 +437,8 @@ process_principals(struct ssh *ssh, FILE
 			found_principal = 1;
 	}
 	free(line);
+	if (!found_principal)
+		verbose("Did not match any principals from auth_principals_* files");
 	return found_principal;
 }
 
@@ -711,7 +717,7 @@ check_authkey_line(struct ssh *ssh, stru
 	    &reason) != 0)
 		goto fail_reason;
 
-	verbose("Accepted certificate ID \"%s\" (serial %llu) "
+	verbose("Accepted cert ID \"%s\" (serial %llu) "
 	    "signed by CA %s %s found at %s",
 	    key->cert->key_id,
 	    (unsigned long long)key->cert->serial,
@@ -781,7 +787,7 @@ static int
 user_cert_trusted_ca(struct ssh *ssh, struct passwd *pw, struct sshkey *key,
     struct sshauthopt **authoptsp)
 {
-	char *ca_fp, *principals_file = NULL;
+	char *ca_fp, *key_fp, *principals_file = NULL;
 	const char *reason;
 	struct sshauthopt *principals_opts = NULL, *cert_opts = NULL;
 	struct sshauthopt *final_opts = NULL;
@@ -797,11 +803,16 @@ user_cert_trusted_ca(struct ssh *ssh, st
 	    options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
 		return 0;
 
+	key_fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_DEFAULT);
+
 	if ((r = sshkey_in_file(key->cert->signature_key,
 	    options.trusted_user_ca_keys, 1, 0)) != 0) {
 		debug2_fr(r, "CA %s %s is not listed in %s",
 		    sshkey_type(key->cert->signature_key), ca_fp,
 		    options.trusted_user_ca_keys);
+		verbose("CA %s %s is not listed in %s",
+		    sshkey_type(key->cert->signature_key), ca_fp,
+		    options.trusted_user_ca_keys);
 		goto out;
 	}
 	/*
@@ -852,6 +863,11 @@ user_cert_trusted_ca(struct ssh *ssh, st
 		if ((final_opts = sshauthopt_merge(principals_opts,
 		    cert_opts, &reason)) == NULL) {
  fail_reason:
+			verbose("Rejected cert ID \"%s\" with signature "
+			    "%s signed by %s CA %s via %s",
+			    key->cert->key_id, key_fp,
+			    sshkey_type(key->cert->signature_key), ca_fp,
+			    options.trusted_user_ca_keys);
 			error("%s", reason);
 			auth_debug_add("%s", reason);
 			goto out;
@@ -859,9 +875,10 @@ user_cert_trusted_ca(struct ssh *ssh, st
 	}
 
 	/* Success */
-	verbose("Accepted certificate ID \"%s\" (serial %llu) signed by "
-	    "%s CA %s via %s", key->cert->key_id,
-	    (unsigned long long)key->cert->serial,
+	verbose("Accepted cert ID \"%s\" (serial %llu) with signature %s "
+	    "signed by %s CA %s via %s",
+	    key->cert->key_id,
+	    (unsigned long long)key->cert->serial, key_fp,
 	    sshkey_type(key->cert->signature_key), ca_fp,
 	    options.trusted_user_ca_keys);
 	if (authoptsp != NULL) {
@@ -876,6 +893,7 @@ user_cert_trusted_ca(struct ssh *ssh, st
 	sshauthopt_free(final_opts);
 	free(principals_file);
 	free(ca_fp);
+	free(key_fp);
 	return ret;
 }
 
--- /dev/null
+++ b/regress/cert-logging.sh
@@ -0,0 +1,84 @@
+tid="cert logging"
+
+CERT_ID="cert_id"
+PRINCIPAL=$USER
+SERIAL=0
+
+log_grep() {
+    if [ "$(grep -c -G "$1" "$TEST_SSHD_LOGFILE")" == "0" ]; then
+        return 1;
+    else
+        return 0;
+    fi
+}
+
+cat << EOF >> $OBJ/sshd_config
+TrustedUserCAKeys $OBJ/ssh-rsa.pub
+Protocol 2
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+AuthorizedPrincipalsFile $OBJ/auth_principals
+EOF
+
+if [ ! -f $OBJ/trusted_rsa ]; then
+    ${SSHKEYGEN} -q -t rsa -C '' -N '' -f $OBJ/trusted_rsa
+fi
+if [ ! -f $OBJ/untrusted_rsa ]; then
+    ${SSHKEYGEN} -q -t rsa -C '' -N '' -f $OBJ/untrusted_rsa
+fi
+
+${SSHKEYGEN} -q -s $OBJ/ssh-rsa -I $CERT_ID -n $PRINCIPAL -z $SERIAL $OBJ/trusted_rsa.pub ||
+    fatal "Could not create trusted SSH cert"
+
+${SSHKEYGEN} -q -s $OBJ/untrusted_rsa -I $CERT_ID -n $PRINCIPAL -z $SERIAL $OBJ/untrusted_rsa.pub ||
+    fatal "Could not create untrusted SSH cert"
+
+CA_FP="$(${SSHKEYGEN} -l -E sha256 -f ssh-rsa | cut -d' ' -f2)"
+KEY_FP="$(${SSHKEYGEN} -l -E sha256 -f trusted_rsa | cut -d' ' -f2)"
+UNTRUSTED_CA_FP="$(${SSHKEYGEN} -l -E sha256 -f untrusted_rsa | cut -d' ' -f2)"
+
+start_sshd
+
+
+test_no_principals() {
+    echo > $OBJ/auth_principals
+    ${SSH} -F $OBJ/ssh_config -i $OBJ/trusted_rsa-cert.pub somehost true ||
+        fatal "SSH failed"
+
+    if ! log_grep 'Did not match any principals from auth_principals_\* files'; then
+        fail "No 'Did not match any principals' message"
+    fi
+
+    if ! log_grep "Rejected cert ID \"$CERT_ID\" with signature $KEY_FP signed by RSA CA $CA_FP via $OBJ/ssh-rsa.pub"; then
+        fail "No 'Rejected cert ID' message"
+    fi
+}
+
+
+test_with_principals() {
+    echo $USER > $OBJ/auth_principals
+    ${SSH} -F $OBJ/ssh_config -i $OBJ/trusted_rsa-cert.pub somehost true ||
+        fatal "SSH failed"
+
+    if ! log_grep "Matched principal \"$PRINCIPAL\" from $OBJ/auth_principals:1 against \"$PRINCIPAL\" from cert"; then
+        fail "No 'Matched principal' message"
+    fi
+    if ! log_grep "Accepted cert ID \"$CERT_ID\" (serial $SERIAL) with signature $KEY_FP signed by RSA CA $CA_FP via $OBJ/ssh-rsa.pub"; then
+        fail "No 'Accepted cert ID' message"
+    fi
+}
+
+
+test_untrusted_cert() {
+    ${SSH} -F $OBJ/ssh_config -i $OBJ/untrusted_rsa-cert.pub somehost true ||
+        fatal "SSH failed"
+
+    if ! log_grep "CA RSA $UNTRUSTED_CA_FP is not listed in $OBJ/ssh-rsa.pub"; then
+        fail "No 'CA is not listed' message"
+    fi
+}
+
+
+test_no_principals
+test_with_principals
+test_untrusted_cert