How to Create and Register SSH Keys

Summary

Notes on the procedure for creating OpenSSH public/private key pairs on Linux and Windows.

2025-12-21 update: Reflects current OpenSSH/SSL library versions on recent OSes.

SSH Configuration Folder

This is where private keys, public keys, and other configuration files for client connections are stored by default.

Supported Certificate Algorithms

The supported certificate algorithm formats differ depending on the OpenSSH/OpenSSL generation for each OS version (distribution).

• All entries reflect the state after the latest updates have been applied
• Recent CentOS/Rocky Linux versions appear to update the OpenSSL 3.x.y sub-version with minor upgrades
• December 2025 note: Post-Quantum Cryptography (PQC) standardization and implementation is advancing in OpenSSH/SSL libraries. While available in some versions, it is unfortunately not yet mainstream. In particular, LibreSSL (common outside Linux) is lagging in PQC implementation, so as of now it appears usable only for Linux-to-Linux connections.

Choosing a Key Algorithm

Select the connection key algorithm in the following order of preference:

1. Ed25519
2. ECDSA (521-bit)
3. RSA (SSH2-RSA 2048-bit or more)
4. DSA (not recommended)

Available algorithms differ by OpenSSH/OpenSSL version. Ideally, create key pairs for all three — Ed25519, ECDSA, and RSA — on the client side, and use the highest-priority algorithm supported by the target server.

Creating Key Pairs

Commands to create RSA, ECDSA, and Ed25519 key pairs (private + public) in one shot.

With “creator’s username and hostname” as the comment, and no passphrase:

Linux OpenSSH (bash)

ssh-keygen -t ed25519 -q -N "" -C ${USER}@${HOSTNAME} -f ~/.ssh/id_ed25519
ssh-keygen -t ecdsa -b 521 -q -N "" -C ${USER}@${HOSTNAME} -f ~/.ssh/id_ecdsa
ssh-keygen -t rsa -b 2048 -q -N "" -C ${USER}@${HOSTNAME} -f ~/.ssh/id_rsa

Windows OpenSSH (PowerShell)

Specifying an “empty string” on the Windows command line requires special notation.

ssh-keygen -t ed25519 -q -N '""' -C "${env:USERNAME}@${env:COMPUTERNAME}" -f ${env:USERPROFILE}/.ssh/id_ed25519
ssh-keygen -t ecdsa -b 521 -q -N '""' -C "${env:USERNAME}@${env:COMPUTERNAME}" -f ${env:USERPROFILE}/.ssh/id_ecdsa
ssh-keygen -t rsa -b 2048 -q -N '""' -C "${env:USERNAME}@${env:COMPUTERNAME}" -f ${env:USERPROFILE}/.ssh/id_rsa

Registering the Public Key on the Target Server

To register a created key on the destination SSH server, append the contents of ./ssh/id_xxx.pub from the source to:

(home directory)/.ssh/authorized_keys

on the destination server. This is surprisingly tedious in practice, so the original OpenSSH package includes a dedicated script for it. If the authorized_keys file doesn’t exist, it will be created with correct permissions automatically.

Linux (CentOS 5/6) Client → Linux Server

REMOTEUSER=xxxx
REMOTEHOST=yyyy
ssh-copy-id -i ${HOME}/.ssh/id_ed25519.pub ${REMOTEUSER}@${REMOTEHOST}
ssh-copy-id -i ${HOME}/.ssh/id_ecdsa.pub ${REMOTEUSER}@${REMOTEHOST}
ssh-copy-id -i ${HOME}/.ssh/id_rsa.pub ${REMOTEUSER}@${REMOTEHOST}

Linux (CentOS 7/8) Client → Linux Server

OpenSSH shipped with CentOS 7 and later can suppress the (yes/no) fingerprint confirmation prompt.

REMOTEUSER=xxxx
REMOTEHOST=yyyy
ssh-copy-id -o StrictHostKeyChecking=no -i ${HOME}/.ssh/id_ed25519.pub ${REMOTEUSER}@${REMOTEHOST}
ssh-copy-id -o StrictHostKeyChecking=no -i ${HOME}/.ssh/id_ecdsa.pub ${REMOTEUSER}@${REMOTEHOST}
ssh-copy-id -o StrictHostKeyChecking=no -i ${HOME}/.ssh/id_rsa.pub ${REMOTEUSER}@${REMOTEHOST}

Windows OpenSSH Client → Linux Server

For Windows (SSH client) → Linux (SSH server):

Windows can’t use bash scripts like ssh-copy-id, so use a one-liner command instead.

$REMOTEUSER = "xxxx"
$REMOTEHOST = "yyyy"
Get-Content ${env:USERPROFILE}/.ssh/id_ed25519.pub | ssh ${REMOTEUSER}@${REMOTEHOST} "umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys || exit 1"
Get-Content ${env:USERPROFILE}/.ssh/id_ecdsa.pub | ssh ${REMOTEUSER}@${REMOTEHOST} "umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys || exit 1"
Get-Content ${env:USERPROFILE}/.ssh/id_rsa.pub | ssh ${REMOTEUSER}@${REMOTEHOST} "umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys || exit 1"

※ Note: no error handling included

Connecting to a Windows sshd Target as Administrator

A public key must be registered in a special file.

${env:ProgramData}/ssh/administrators_authorized_keys

To register via GUI, open the file in Notepad with administrator privileges, then paste the key.

notepad ${env:ProgramData}/ssh/administrators_authorized_keys

Open Issues

• Windows SSH client → Windows SSH server
• Linux SSH client → Windows SSH server

A one-shot registration method like ssh-copy-id for these combinations is currently unknown.

It would probably be possible by installing PowerShell 7 on both sides and running PowerShell commands over a Remote-Session connection, but that feels like a case of the means becoming the end, so I’m not pursuing it further.