Options

-a num_trials
Specifies the number of primality tests or trials to perform when screening DH-GEX candidates using the -T command. The minimum number of trials is 4.
-A
For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment.
–b bits
Specifies the number of bits in the key to create. For RSA keys, the minimum size is 768 bits, the maximum size is 16384 bits, and the default is 2048 bits.
Note: When the -G option is on, the minimum size is 512 bits.
Generally, 2048 bits is considered sufficient. DSA keys must be exactly 1024 bits as specified by FIPS 186-2. For ECDSA keys, the -b flag determines the key length by selecting from one of three elliptic curve sizes: 256, 384 or 521 bits. Attempting to use bit lengths other than these three values for ECDSA keys will fail.
–B
Shows the bubble babble digest of specified private or public key file. Bubble Babble is a text format for fingerprint. For example: 1024 xekib-ridyd-mybuh-fpun-bybir-nagak-netoc-nogib-zacev-sotim-luxex user@host.pok.ibm.com.
–c
Requests changing the comment in the private and public key files. This operation is only supported for RSA1 keys. The program will prompt for the file containing the private keys, for the passphrase if the key has one, and for the new comment, when –P, –C, and –f are not specified. It updates both public and private keys. This option is mutually exclusive with the –p option. Comments are truncated after 1023 characters. In addition, the comment length is limited by the terminal interface. For long comments up to 1023 characters, use the –C option.
–C comment
Provides the new comment. The comment is truncated after 1023 characters.
–D pkcs11
Not supported in z/OS Unix. Download the RSA public keys provided by the PKCS#11 shared library pkcs11. When used in combination with -s, this option indicates that a CA key resides in a PKCS#11 token (see Certificates for details).
–e
Reads a private or public OpenSSH key file and prints a public key in RFC 4716 SSH Public Key File Format to stdout. This option allows exporting public keys for use by several commercial SSH implementations.

If using a SAF key ring on the local system, but not on a remote system, this option can be used with the _ZOS_SSH_KEY_RING_LABEL environment variable to export your public key from the key ring. The public key can then be copied to the remote system and imported with ssh-keygen -i.

Restriction: This option applies to protocol version 2 only.

–f filename
If –F, –H, or –R is specified, filename specifies the file name of the known_hosts file. For other options, filename specifies the file name of the key file. The filename is limited to 1023 characters including the 4 characters for ".pub" for the public keys.

For some of the options allowing [-f input_keyfile], the _ZOS_SSH_KEY_RING_LABEL environment variable can be used to specify a key ring and certificate label to be used, overriding the -f option. For more information about how the environment variable is used, see _ZOS_SSH_KEY_RING_LABEL.

–F hostname
Searches for the specified hostname in a known_hosts file, listing any occurrences found. Use this option to find hashed host names or addresses. It can also be used in conjunction with the –H option to print found keys in a hashed format If -f is not specified, ~/.ssh/known_hosts is used.
–g
Uses generic DNS resource record format when printing fingerprint resource records using the -r command.
–G output_file
Generates candidate primes for DH-GEX.

Rule: These primes must be screened for safety (using the -T option) before use.

–h
When signing a key, create a host certificate instead of a user certificate. See Certificates for details.
–H
Hashes a known_hosts file. This option replaces all host names and addresses with hashed representations within the specified file; the original contents are moved to a file with a .old suffix. These hashes can be used normally by ssh and sshd, but they do not reveal identifying information if the file's contents are disclosed. This option will not modify existing hashed host names and is therefore safe to use on files that mix hashed and non-hashed names. If -f is not specified, ~/.ssh/known_hosts is used.
–i
Reads an unencrypted private (or public) key file in SSH protocol version 2 format and prints an OpenSSH compatible private (or public) key to stdout. ssh-keygen also reads the RFC 4716 SECSH Public Key File Format. This option allows importing keys from several commercial SSH implementations.
–I certificate_identity
Specify the key identity when signing a public key. See Certificates for details.
–j start-line
Start screening at the specified line number while performing DH candidate screening using the -T option.
–J num_lines
Exit after screening the specified number of lines while performing DH candidate screening using the -T option.
–k
Generate a KRL file. In this mode, ssh-keygen will generate a KRL file at the location specified by way of the -f flag that revokes every key or certificate presented on the command line. Keys/certificates to be revoked may be specified by public key file or using the format described in Key revocation lists.
–K checkpt
Write the last line processed to the file checkpt while performing DH candidate screening using the -T option. This will be used to skip lines in the input file that have already been processed if the job is restarted. This option allows importing keys from other software, including several commercial SSH implementations. The default import format is “RFC4716”.
–l
Shows the fingerprint of specified public key file. Private protocol version 1 RSA1 keys are also supported. For RSA and DSA keys, ssh-keygen tries to find the matching public key file and prints its fingerprint. For example: 1024 7d:74:a5:4b:7b:10:5d:62:4b:9f:f3:1c:14:32:b8:74 user@host.pok.ibm.com. If combined with -v, an ASCII art representation of the key is supplied with the fingerprint.
–L
Prints the contents of a certificate.
–m key_format
Specify a key format for the -i (import) or -e (export) conversion options. The supported key formats are: “RFC4716” (RFC 4716/SSH2 public or private key), “PKCS8” (PEM PKCS8 public key) or “PEM” (PEM public key). The default conversion format is “RFC4716”.
–M memory
Specifies the amount of memory (in megabytes) to use when generating candidate moduli for DH-GEX. The number of specified megabytes must be an integer value greater than 7 and less than 128.
–n principals
Specify one or more principals (user or host names) to be included in a certificate when signing a key. Multiple principals may be specified, separated by commas. See Certificates for details.
–N new_passphrase
Provides the new passphrase. When –t type or –d options are used, the –P value will be used for passphrase regardless if –N is specified. If –P is not specified with –t type or –d, the –N value will be used for the passphrase.

Rule: Do not specify passphrases on the command line because this method allows the passphrase to be visible (for example, when the ps utility is used).

–O option
Specify a certificate option when signing a key. This option may be specified multiple times. See Certificates for details. The options that are valid for user certificates are as follows:
clear
Clear all enabled permissions. This is useful for clearing the default set of permissions so permissions may be added individually.
force-command=command
Forces the execution of command instead of any shell or command specified by the user when the certificate is used for authentication.
no-agent-forwarding
Disable ssh-agent(1) forwarding (permitted by default).
no-port-forwarding
Disable port forwarding (permitted by default).
no-pty
Disable PTY allocation (permitted by default).
no-user-rc
Disable execution of ~/.ssh/rc by sshd(8) (permitted by default).
no-x11-forwarding
Disable X11 forwarding (permitted by default).
permit-agent-forwarding
Allows ssh-agent(1) forwarding.
permit-port-forwarding
Allows port forwarding.
permit-pty
Allows PTY allocation.
permit-user-rc
Allows execution of ~/.ssh/rc by sshd(8).
permit-x11-forwarding
Allows X11 forwarding.
source-address=address_list
Restrict the source addresses from which the certificate is considered valid. The address_list is a comma separated list of one or more address/netmask pairs in CIDR format.
At present, no options are valid for host keys.
–p
Requests changing the passphrase of a private key file instead of creating a new private key. The program will prompt for the file containing the private key, for the old passphrase, and twice for the new passphrase.
–P passphrase
Provides the old passphrase. When the –t type or –d options are used, the –P value is used for the passphrase regardless if –N is specified. When the –t type or –d options are used, it is recommended that –N new_passphrase be used instead of –P passphrase.

Rule: Do not specify passphrases on the command line because this method allows the passphrase to be visible (for example, when the ps utility is used).

–q
Suppresses messages. Useful when called from a script.
–Q
Test whether keys have been revoked in a Key Revocation List.
–r hostname
Prints the SSHFP fingerprint resource record named hostname for the specified public key file. If -f is not specified, the default files /etc/ssh/ssh_host_rsa_key and /etc/ssh/ssh_host_dsa_key are used in sequence.
–R hostname
Removes all keys belonging to hostname from a known_hosts file. Use this option to delete hashed hosts (see the -H option). If -f is not specified, ~/.ssh/known_hosts is used.
–s ca_key
Certify (sign) a public key using the specified CA key. See Certificates for details.

When generating a key revocation list, -s specifies a path to a CA public key file used to revoke certificates directly by key ID or serial number. See Key revocation lists for details

–S start
Specifies the start point in hexadecimal format when generating candidate moduli for DH-GEX. The specified start point must be a valid hexadecimal value.
–t type
Specifies the type of the key to create. The possible values are rsa1 for protocol version 1 and rsa, dsa, or ecdsa for protocol version 2. The program will prompt for the file name to contain the private keys and passphrase, if –P or –N, and –f is not specified.
–T output_file
Tests Diffie-Hellman Group Exchange candidate primes (generated using the -G option) for safety.
–u
Update a key revocation list (KRL). When specified with -k, keys listed by way of the command line are added to the existing KRL rather than a new KRL being created.
–U reader
Not supported in z/OS® UNIX. Uploads an existing RSA private key into the smart card in reader.
–v
Verbose mode. Causes ssh-keygen to print debugging messages about its progress. The messages are helpful for debugging moduli generation. Multiple –v options increase the verbosity. You can specify up to three -v options.
–V validity_interval
Specify a validity interval when signing a certificate. A validity interval may consist of a single time, indicating that the certificate is valid beginning now and expiring at that time, or may consist of two times separated by a colon to indicate an explicit time interval. The start time may be specified as a date in YYYYMMDD format, a time in YYYYMMDDHHMMSS format or a relative time (to the current time) consisting of a minus sign followed by a relative time in the format described in the TIME FORMATS section of sshd_config(5). The end time may be specified as a YYYYMMDD date, a YYYYMMDDHHMMSS time or a relative time starting with a plus character.

For example: “+52w1d” (valid from now to 52 weeks and one day from now), “-4w:+4w” (valid from four weeks ago to four weeks from now), “20100101123000:20110101123000” (valid from 12:30 PM, January 1st, 2010 to 12:30 PM, January 1st, 2011), “-1d:20110101” (valid from yesterday to midnight, January 1st, 2011).

–W generator
Specifies the desired generator when testing candidate module for DH-GEX. Valid generator values are 2, 3, or 5.
–x
Same as –e. It is recommended that –e be used instead of –x.
–X
Same as –i. It is recommended that –i be used instead of –X.
–y
Reads a private OpenSSH format file and prints an OpenSSH public key to stdout.
–z serial_number
Specifies a serial number to be embedded in the certificate to distinguish this certificate from others from the same CA. The default serial number is zero.

When generating a key revocation list (KRL), the -z flag is used to specify a KRL version number.