Show Contents / Index / Search

ssh-keygen Command Line Options

The ssh-keygen syntax is:

ssh-keygen [-7 file] [-b bits] [-c comment] [-D private_key] [-e private_key]
[-F key] [-h] [-H key] [-i key] [-k file] [-N new_passphrase] [-o key_name]
[-O key_file] [-p passphrase] [-P] [-q] [-t key_type] [-V] [-X cert] [key_name1 key_name2 ...]

Use ssh-keygen to create RSA and DSA keys for public key authentication, to edit the properties of existing keys, and to convert key file formats for compatibility with other Secure Shell implementations.

When no options are specified, ssh-keygen generates a 2048-bit RSA key pair and queries you for a passphrase to protect the private key. If you don't specify a file name on the command line, keys are created in ~/.ssh2/ and given a default name that identifies the key type, size, and host name (for example /home/joe/.ssh2/id_rsa_2048_myhost_a). If you specify a file name, keys are saved to the current working directory unless you include a fully qualified path name. For each private key you create, ssh-keygen also generates a public key. Public keys are given the same base name as the private key, with an added .pub extension (for example id_rsa_2048_myhost_a.pub).

Command Line Options

Options are available in both a single-character form (such as -b) and a descriptive equivalent (--bits). Single characters are shown here. To view the descriptive equivalents, use the -h command line option.

-7 file

Extracts certificate(s) and CRL(s) from the specified PKCS#7 file.

-b bits

Specifies the key size. Up to a point, a larger key size improves security. Increasing key size slows down the initial connection, but has no effect on the speed of encryption or decryption of the data stream after a successful connection has been made. The length of key you should use depends on many factors, including: the key type, the lifetime of the key, the value of the data being protected, the resources available to a potential attacker, and the size of the symmetric key you use in conjunction with this asymmetric key. To ensure the best choice for your needs, we recommend that you contact your security officer. The default for RSA keys is 2048 bits and 1024 bits for DSA keys. The minimum allowed value is 512. The maximum allowed value is 32768.

-c comment

Specifies information for the comment field within the key file. Use quotation marks if the string includes spaces. If you do not specify a comment, a default comment is created that includes the key type, creator, date, and time. Note: The comment is displayed when a passphrase-protected key is used for client authentication. Don't store passphrases or other sensitive information in the comment.

-D private_key

Uses the specified private key to derive a new copy of the public key.

-e private_key

Changes the passphrase of the specified private key. When you use this option alone you will be queried for the old and new passphrase for the specified private key. To edit the passphrase without opening an interactive session, you can use this option in combination with -p and-N. To change to a null passphrase, you can use this option in combination with -P.

-F key

Displays the fingerprint of the specified key in Bubble Babble format.

-h

Displays a brief summary of command options.

-H key

Uses the specified Reflection public key to generate a public key in OpenSSH format. The converted key is created using the same base file name with an added .ssh extension. You can use the key that is created to configure public key client authentication on an OpenSSH server.

-i key

Displays information about the specified key.

-k file

Extracts certificate(s) and private key(s) from the specified PKCS #12 file.

-N new_passphrase

Changes the passphrase to the specified new passphrase. Use this option in combination with -e.

-o key_name

Specifies the filename for the generated private key. (A public key is also created and is always given the same name as the private key plus a .pub file extension.) Note: An alternate way of naming key files is to specify one or more key filenames at the end of the ssh-keygen command.

-O key

Uses the specified OpenSSH public or private key to create a public or private key in Reflection format. The converted key is created using the same base file name with an added .ssh2 extension.

-p passphrase

Specifies a passphrase. Use quotation marks if the phrase includes spaces. This option creates the initial passphrase when you generate a new key. If you are managing an existing key, use this option to specify the passphrase that protects that key. If a passphrase is required and you don't use -p, you'll be prompted for the passphrase. Ensure that you follow your company's security policy for password length and complexity.

-P

Creates a key with no passphrase. You can use this option to create keys for server authentication. Passphrases are strongly recommended for client keys. Passphraseless keys should be used only for accounts that require unattended authentication (such as file transfer scripts). Passphraseless private key files should be protected using operating system file access controls (key file = 400, directory containing the key = 700).

-q

Hides the key generation progress indicator.

-t key_type

Specifies the algorithm used for key generation. Possible values are "rsa" and "dsa". The default is "rsa".

-V

Displays ssh-keygen version information.

-X cert

Extracts the public key from the specified X.509 certificate file.

[key_name1 key_name2...]

Specifies the file name (or names) to be used for the generated private key (or keys). The public key is created using the same name with a ".pub" file extension.