-A | Generate host keys of all default key types (rsa, ecdsa, mldsa44-ed25519 and ed25519) if they do not already exist. | man |
-a rounds | When saving a private key, this option specifies the number of KDF (key derivation function, currently bcrypt_pbkdf(3)) rounds used. | man |
-B | Show the bubblebabble digest of specified private or public key file. | man |
-b bits | Specifies the number of bits in the key to create. | man |
-C comment | Provides a new comment. | man |
-c | Requests changing the comment in the private and public key files. | man |
-D pkcs11 | Download the public keys provided by the PKCS#11 shared library pkcs11. | man |
-E fingerprint_hash | Specifies the hash algorithm used when displaying key fingerprints. | man |
-e | This option will read a private or public OpenSSH key file and print to stdout a public key in one of the formats specified by the -m option. | man |
-F hostname | Search for the specified hostname (with optional port number) in a known_hosts file, listing any occurrences found. | man |
-f filename | Specifies the filename of the key file. | man |
-g | Use generic DNS format when printing fingerprint resource records using the -r command. | man |
-H | Hash a known_hosts file. | man |
-h | When signing a key, create a host certificate instead of a user certificate. | man |
-I certificate_identity | Specify the key identity when signing a public key. | man |
-i | This option will read an unencrypted private (or public) key file in the format specified by the -m option and print an OpenSSH compatible private (or public) key to stdout. | man |
-K | Download resident keys from a FIDO authenticator. | man |
-k | Generate a KRL file. | man |
-L | Prints the contents of one or more certificates. | man |
-l | Show fingerprint of specified public key file. | man |
-M generate | Generate candidate Diffie-Hellman Group Exchange (DH-GEX) parameters for eventual use by the ‘diffie-hellman-group-exchange-’ key exchange methods. | man |
-m key_format | Specify a key format for key generation, the -i (import), -e (export) conversion options, and the -p change passphrase operation. | man |
-N new_passphrase | Provides the new passphrase. | man |
-n principals | Specify one or more principals (user or host names) to be included in a certificate when signing a key. | man |
-O option | Specify a key/value option. | man |
-P passphrase | Provides the (old) passphrase. | man |
-p | Requests changing the passphrase of a private key file instead of creating a new private key. | man |
-Q | Test whether keys have been revoked in a KRL. | man |
-q | Silence ssh-keygen. | man |
-R hostname | Removes all keys belonging to the specified hostname (with optional port number) from a known_hosts file. | man |
-r hostname | Print the SSHFP fingerprint resource record named hostname for the specified public key file. | man |
-s ca_key | Certify (sign) a public key using the specified CA key. | man |
-t ecdsa | Specifies the type of key to create. | man |
-U | When used in combination with -s or -Y sign, this option indicates that a CA key resides in an ssh-agent(1). | man |
-u | Update a KRL. | man |
-V validity_interval | Specify a validity interval when signing a certificate. | man |
-v | Verbose mode. | man |
-w provider | Specifies a path to a library that will be used when creating FIDO authenticator-hosted keys, overriding the default of using the internal USB HID support. | man |
-Y find-principals | Find the principal(s) associated with the public key of a signature, provided using the -s flag in an authorized signers file provided using the -f flag. | man |
-y | This option will read a private OpenSSH format file and print an OpenSSH public key to stdout. | man |
-Z cipher | Specifies the cipher to use for encryption when writing an OpenSSH-format private key file. | man |
-z serial_number | Specifies a serial number to be embedded in the certificate to distinguish this certificate from others from the same CA. | man |