---
title: ssh-keygen — key generation and management
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A command that creates ssh key pairs and checks fingerprints and public keys. The foundation of passwordless server access.
tags: program, Remote server connection management, ssh-keygen
---

**💬 "ssh-keygen command"**

ssh-keygen creates a **private/public key pair**. Place the public key on the server to connect without a password.

Recently, the short and secure `ed25519` type is recommended.

- **Concept**: Generates and inspects key pairs for authentication.
- **Private key**: `id_ed25519` — never share it.
- **Public key**: `id_ed25519.pub` — the value placed in the server's authorized_keys.
- **Fingerprint**: Use -l -f to check the key fingerprint.
## Commonly used options

| Option | Description |
| --- | --- |
| -t ed25519 | Specifies the key type (recommended) |
| -C "comment" | Adds a comment to the key (usually account/purpose) |
| -f <path> | Specifies the key file path to save |
| -l -f <key> | Checks the fingerprint of an existing key |

## Three essential command combinations

- `ssh-keygen -t ed25519 -C 'deploy@ci' -f ~/.ssh/deploy_ed25519` — Generate a deployment key
- `ssh-keygen -l -f ~/.ssh/deploy_ed25519.pub` — Check the public key fingerprint
- `ssh-copy-id -i ~/.ssh/deploy_ed25519.pub deploy@10.0.0.9` — Register the public key on the server
**💬 "Show me a useful example for checking right after deployment"**

This is a step-by-step rundown of situations commonly encountered on live servers.

### Step 1 · Key generation

Create it with a filename that indicates its purpose.

```
ssh-keygen -t ed25519 -C 'deploy@ci' -f ~/.ssh/deploy_ed25519
```

### Step 2 · Public key registration

Add it to the target server's authorized_keys.

```
ssh-copy-id -i ~/.ssh/deploy_ed25519.pub deploy@10.0.0.9
```

### Step 3 · Connection verification

Check that you can connect without a password.

```
ssh -i ~/.ssh/deploy_ed25519 deploy@10.0.0.9 'echo OK'
```

## How it is used in practice

### 1. Issuing a CI deployment key

**Situation** — A CI pipeline needs a dedicated key to deploy to servers.

```
ssh-keygen -t ed25519 -C 'ci-deploy' -f ~/.ssh/ci_deploy -N ''
```

**Result** — A passwordless key is generated and can be used immediately by CI.

**Point** — Separate CI keys by purpose and manage them so they can be replaced immediately if leaked.

### 2. Checking a key fingerprint

**Situation** — You need to verify that the key registered on the server is correct.

```
ssh-keygen -l -f ~/.ssh/id_ed25519.pub
```

**Result** — The SHA256 fingerprint is printed so you can compare it with the server's authorized_keys.

**Point** — Fingerprint comparison is a basic procedure in key rotation and audits.

## Things to keep in mind

- Never share or commit private keys externally.
- Passwordless keys are convenient but risky if leaked. Use them only in isolated environments like CI.
- Key file permissions must be 600, and the .ssh directory must be 700.
- Overwriting an existing key can break access, so specify the -f path carefully.
## Actual execution screen

This is the result of generating an ed25519 deployment key.

![ssh-keygen command execution result: key generation and fingerprint](https://games.aidebatehub.com/assets/ssh-keygen-demo.png)

A real production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/remote/ssh-keygen.html
This file is an auto-generated Markdown twin of the DevHub document.