Ssh-keygen (command)

ssh-keygen is an OpenSSH software command used to generate, manage, and convert authentication keys. It support at least four different key types RSA, DSA, ECDSA and ed25519.

Commands

Generate a keypar:

• ssh-keygen -t ed25519 (There is no need to set the key size, as all Ed25519 keys are 256 bits) other options:

[-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]

Two files will be generated, one your private key and a second file containing second key (.pub extension)

• ssh-keygen -t ed25519 -f your_new_ed25519_key

• ssh-keygen -t rsa -f your_new_rsa_key

• ssh-keygen -A Generate all (-A) rsa, dsa, ecdsa and ed25519 key types.

• Generate FIDO key:

 ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk
 Generating public/private ecdsa-sk key pair.

• Convert:

ssh-keygen -e -m PEM -f private_key_in_ed25519_format
do_convert_to_pem: unsupported key type ED25519

• ssh-keygen -l -f ~/.ssh/ssh_host_XXXXkey.pub

 -l      Show fingerprint of specified public key file.

.ssh_host_XXXXkey.pub is not a public key file.

Legacy format:

• ssh-keygen -l -E md5 -f ~/.ssh/ssh_host_XXXXkey.pub

See also: puttygen -O fingerprint

• ssh-keygen -vF host (-v flag added in OpenSSH 8.1)

Changelog

• OpenSSH 7.8, released in August 2018 Incompatible changes: ssh-keygen write OpenSSH format private keys by default instead of using OpenSSL's PEM format.

Activities

• Generate a new public private key using ed25519 key format using the following command:

ssh-keygen -t ed25519

• Solve" "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" warning:

ssh-keygen -R SERVER_NAME -R Removes all keys belonging to hostname from a known_hosts file

ssh -oStrictHostKeyChecking=no SERVER_NAME Temporarily turning off host key checking

Both solutions have security implications.

• Understand different key types: dsa, ecdsa, ed25519 and RSA

• Generate public key from private key:

ssh-keygen -y -f ~/.ssh/id_rsa > ~./.ssh/id_rsa.pub

• Generate a key par with old PEM format using:

ssh-keygen -m PEM

• Changing the private key's passphrase without changing the key

ssh-keygen -f ~/.ssh/id_rsa -p

-p change the passphrase of a private key file

• Generate fingerprint or ID of a key

ssh-keygen -lf your_key.pub
2048 SHA256:u6IaFqRcwp0QX0nPBa/HHB2k/g73tH+YkoaE0riGRAT NAME@XX (RSA)

ssh-keygen -lf your_key
your_key is not a key file.

Related commands

• ssh-copy-id
• openssl: openssl rsa -in mykey.pem -pubout > mykey.pub, openssl genrsa
• puttygen (PuTTY)

See also

• CA, Root Certificates, FreeIPA, PKI, OpenCA, Wildcard certificate, certtool, certbot (Let's Encrypt), certinfo (Cloudflare), ACME, Boulder, cfssl (Cloudflare), Public key certificate, public key, TLS and X.509, OCSP, Subject Alternative Name (SAN), openssl ca, Self signed certificate, CSR, keytool, ACM, KMS, aws acm, IdenTrust, multirootca, cert-manager, ca_cert_identifier
• SSH: ssh, TLS, .ppk, .pem, .crt, .pub, ED25519, Key exchange method (KEX), public key, private key, ssh -Q kex, IAMUserSSHKeys, known_hosts, ssh tunnel, Dropbear
• passwd, ssh-keygen, chage, /etc/passwd, Password policy, Passwd (package), mkpasswd, cracklib-check, Password cracking, Phone to sign in, Passkey, htpasswd
• OpenSSH (changelog): /etc/ssh/sshd_config | /etc/ssh/ssh_config | ~/.ssh/ | openSSL | sshd logs | sftp | scp | authorized_keys | ssh-keygen | ssh-keyscan | ssh-add | ssh-agent | ssh | Ssh -O stop | ssh-copy-id | CheckHostIP | UseKeychain, OpenSSF
• Kerberos
• Cisco IOS/Configure public RSA key authentication

http://man7.org/linux/man-pages/man1/ssh-keygen.1.html

https://superuser.com/questions/421997/what-is-a-ssh-key-fingerprint-and-how-is-it-generated

https://www.openssh.com/txt/release-8.1

https://wiki.archlinux.org/index.php/SSH_keys#Changing_the_private_key's_passphrase_without_changing_the_key