ssh-keygen (command)
ssh-keygen[1] is an OpenSSH software command used to generate, manage, and convert authentication keys. It support at least four different key types RSA, DSA, ECDSA and ed25519.
Commands
Generate a key par
ssh-keygenssh-keygen -t ed25519(There is no need to set the key size, as all ed25519 keys are 256 bits) other options:
[-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]
- Two files will be generated, one your private key and a second file containing second key (
.pubextension)
- Two files will be generated, one your private key and a second file containing second key (
ssh-keygen -t ed25519 -f your_new_ed25519_key
ssh-keygen -t ed25519 -f your_new_ed25519_key -C "your_coment_or_email_address
ssh-keygen -t rsassh-keygen -t rsa -f your_new_rsa_key
ssh-keygen -AGenerate all (-A) rsa, dsa, ecdsa and ed25519 key types.
- Generate FIDO key:
ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_skGenerating public/private ecdsa-sk key pair.
Generate with PEM format:
ssh-keygen -m PEMssh-keygen -m PEM -t rsa -f your_new_rsa_key.pem
Convert
ssh-keygen -e -m PEM -f private_key_in_ed25519_format do_convert_to_pem: unsupported key type ED25519
ssh-keygen -l -f ~/.ssh/ssh_host_XXXXkey.pub-l Show fingerprint of specified public key file.
.ssh_host_XXXXkey.pub is not a public key file.
Legacy format
ssh-keygen -l -E md5 -f ~/.ssh/ssh_host_XXXXkey.pub
See also: puttygen -O fingerprint
ssh-keygen -vF host(-v flag added in OpenSSH 8.1[3])
Changelog
- OpenSSH 7.8, released in August 2018 Incompatible changes: ssh-keygen write OpenSSH format private keys by default instead of using OpenSSL's PEM format.
Activities
- Generate a new public private key using
ed25519key format using the following command:
ssh-keygen -t ed25519
- Solve" "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" warning:
ssh-keygen -R SERVER_NAME-R Removes all keys belonging to hostname from aknown_hostsfilessh -oStrictHostKeyChecking=no SERVER_NAMETemporarily turning off host key checking- Both solutions have security implications.
- Change or encrypt private key withouth changing the key: [4]
ssh-keygen -f ~/.ssh/id_rsa -p
- Generate public key from private key:
ssh-keygen -y -f ~/.ssh/id_rsa > ~./.ssh/id_rsa.pub
- Generate a key par with old PEM format using:
- Changing the private key's passphrase without changing the key[5]
ssh-keygen -f ~/.ssh/id_rsa -p
-pchange the passphrase of a private key file
- Generate fingerprint or ID of a key
ssh-keygen -lf your_key.pub 2048 SHA256:u6IaFqRcwp0QX0nPBa/HHB2k/g73tH+YkoaE0riGRAT NAME@XX (RSA)
ssh-keygen -lf your_key your_key is not a key file.
Related terms
ssh-copy-idopenssl:openssl rsa,openssl genrsa,openssl reqputtygen(PuTTY)- 0600
- Cisco IOS/Configure public RSA key authentication
- Terraform resource:
tls_private_key aws ec2 create-key-pairgcloud iam service-accounts keys creategcloud kms keys creategpg --gen-key- Terraform:
aws_key_pair - Create new x509 certificate: openssl req -x509 -newkey
See also
ssh-keygen[-R,-t|-p|-i|-y | -f | ~/.ssh/id_rsa|--help ] ~/.ssh/known_hosts- OpenSSH (changelog):
/etc/ssh/sshd_config|/etc/ssh/ssh_config|~/.ssh/|openSSL | sshd logs|sftp|scp|authorized_keys|ssh-keygen|ssh-keyscan|ssh-add|ssh-agent|ssh|Ssh -O stop|ssh-copy-id|CheckHostIP|UseKeychain, OpenSSF - AAA, Kerberos, KDC,
kinit, klist, ktutil, /etc/krb5.conf, krb5-workstation, pam_krb5 - Public key cryptography,
private key,public key,key length,ssh-keygen,ssh-keyscan, Root certificate, KEX, Generate a key
Advertising:
