Ssh-keygen (command)

ssh-keygen is an OpenSSH software command used to generate, manage, and convert authentication keys. It support at least four different key types RSA, DSA, ECDSA and ed25519.

Commands

Generate a keypar:

• ssh-keygen -t ed25519 (There is no need to set the key size, as all Ed25519 keys are 256 bits) other options: [-t dsa | ecdsa | ed25519 | rsa]

Two files will be generated, one your private key and a second file containing second key (.pub extension)

• ssh-keygen -t ed25519 -f your_new_ed25519_key

• ssh-keygen -t rsa -f your_new_rsa_key

• Generate FIDO key:

 ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk
 Generating public/private ecdsa-sk key pair.

• Convert:

ssh-keygen -e -m PEM -f private_key_in_ed25519_format
do_convert_to_pem: unsupported key type ED25519

• ssh-keygen -l -f ~/.ssh/ssh_host_XXXXkey.pub

 -l      Show fingerprint of specified public key file.

.ssh_host_XXXXkey.pub is not a public key file.

Legacy format:

• ssh-keygen -l -E md5 -f ~/.ssh/ssh_host_XXXXkey.pub

See also: puttygen -O fingerprint

• ssh-keygen -vF host (-v flag added in OpenSSH 8.1)

Activities

• Generate a new public private key using ed25519 key format using the following command:

ssh-keygen -t ed25519

• Solve" "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" warning:

ssh-keygen -R SERVER_NAME -R Removes all keys belonging to hostname from a known_hosts file

ssh -oStrictHostKeyChecking=no SERVER_NAME Temporarily turning off host key checking

Both solutions have security implications.

• Understand different key types: dsa, ecdsa, ed25519 and rsa
• Generate public key from private key:

ssh-keygen -y -f ~/.ssh/id_rsa > ~./.ssh/id_rsa.pub

• Generate a key par with old PEM format using:

ssh-keygen -m PEM

• Changing the private key's passphrase without changing the key

ssh-keygen -f ~/.ssh/id_rsa -p

-p change the passphrase of a private key file

Related commands

• ssh-copy-id
• openssl: openssl rsa -in mykey.pem -pubout > mykey.pub
• puttygen (PuTTY)

See also

• CA, Root Certificates, FreeIPA, PKI, OpenCA, Wildcard certificate, certtool, certbot (Let's Encrypt), certinfo (Cloudflare), ACME, Boulder, cfssl (Cloudflare), Public key certificate, public key, TLS and X.509, OCSP, Subject Alternative Name (SAN), openssl ca, Self signed certificate, CSR, keytool, ACM, KMS, aws acm, IdenTrust, multirootca, cert-manager, ca_cert_identifier
• SSH: ssh, TLS, .ppk, .pem, .crt, .pub, ED25519, Key exchange method (KEX), public key, private key, ssh -Q kex, IAMUserSSHKeys, known_hosts, ssh tunnel, Dropbear
• passwd, ssh-keygen, chage, /etc/passwd, Password policy, Passwd (package), mkpasswd, cracklib-check, Password cracking, Phone to sign in, Passkey, htpasswd
• OpenSSH (changelog): /etc/ssh/sshd_config | /etc/ssh/ssh_config | ~/.ssh/ | openSSL | sshd logs | sftp | scp | authorized_keys | ssh-keygen | ssh-keyscan | ssh-add | ssh-agent | ssh | Ssh -O stop | ssh-copy-id | CheckHostIP | UseKeychain, OpenSSF
• Kerberos
• Cisco IOS/Configure public RSA key authentication

http://man7.org/linux/man-pages/man1/ssh-keygen.1.html

https://superuser.com/questions/421997/what-is-a-ssh-key-fingerprint-and-how-is-it-generated

https://www.openssh.com/txt/release-8.1

https://wiki.archlinux.org/index.php/SSH_keys#Changing_the_private_key's_passphrase_without_changing_the_key