My advice would to be use ssh public keys rather than certs unless you absolutely have a burning need to use certs.
As the X.509 support is only available via a patch (in openssh at least), you can never be sure if the patches will be maintained with newer versions of openssh.