diff --git a/command/ssh.go b/command/ssh.go
index 5b745ac08..03e1933da 100644
--- a/command/ssh.go
+++ b/command/ssh.go
@@ -316,6 +316,7 @@ func (c *SSHCommand) handleTypeCA() error {
 	cmd := exec.Command("ssh", args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
 	err = cmd.Run()
 	if err != nil {
 		return errors.Wrap(err, "failed to run ssh command")
@@ -381,6 +382,7 @@ func (c *SSHCommand) handleTypeOTP() error {
 
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
 	err = cmd.Run()
 	if err != nil {
 		return errors.Wrap(err, "failed to run ssh command")
@@ -430,6 +432,7 @@ func (c *SSHCommand) handleTypeDynamic() error {
 	cmd := exec.Command("ssh", args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
 	err = cmd.Run()
 	if err != nil {
 		return errors.Wrap(err, "failed to run ssh command")
diff --git a/website/source/docs/secrets/ssh/signed-ssh-certificates.html.md b/website/source/docs/secrets/ssh/signed-ssh-certificates.html.md
index f5b0e4d96..b377ddd4f 100644
--- a/website/source/docs/secrets/ssh/signed-ssh-certificates.html.md
+++ b/website/source/docs/secrets/ssh/signed-ssh-certificates.html.md
@@ -299,7 +299,7 @@ target machines.
     ```
 
     ```text
-    $ vault -field=public_key read ssh-host-signer/config/ca
+    $ vault read -field=public_key ssh-host-signer/config/ca
     ```
 
 1. Add the resulting public key to the `known_hosts` file with authority.