Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the private DSA key in PEM format. What do I do next to access SSH without a password?

Sample certificate in PEM format:

share|improve this question

Ah -- I think you are confusing ssh certificates and ssl certificates.

ssh uses two forms of two main forms of two-factor authentication keys: 1) standard RSA or DSA key pairs (public, private) or 2) ssh certificates which (according to man ssh-keygen)

...consist of a public key, some identity informa- tion, zero or more principal (user or host) names and an optional set of constraints that are signed by a Certification Authority (CA) key.

it goes on to say:

Note that OpenSSH certificates are a different, and much simpler, format to the X.509 certificates used in ssl(8).

To generate a normal ssh keypair, do something like the following:

ssh-keygen -t rsa -b 2048 -f test

It is advisable to protect the private key with a password.

Then, by placing the public key ( in this case) in the file ~/.ssh/authorized_keys on the target host user's login home, you should be able to login to the target host without a password if sshd is configured to allow this.

ssh -i test user@host

To generate an ssh certificate, do something like the following:

  1. ssh-keygen -f ca_key # generate a ssh keypair for use as a certificate
  2. generate a host key ssh-keygen -s ca_key -I cert_identifier -h
  3. specify the host key in the server's sshd config file: TrustedUserCAKeys /etc/ssh/ssh_cert/
  4. generate a local certificate to access the host using an ssh certificate: ssh-keygen -s ca_key -I cert_identifier This should generate

Assuming this has all proceeded properly, ssh -i user_key user@host will use the file and login will proceed automatically (if allowed on the server). The server will log a connection from *cert_identifier* if so configured.

ssh certificates are a new feature and still need some usability aspects shaken out. The benefits of them include a central signing key, an alternative to constraining connections through authorized_keys and the possibility of limiting the validity timeperiods of ssh certificates.

share|improve this answer
Actually, there is a patch to give ssh X.509 certificate support. See – rorycl Apr 29 '11 at 2:03

This may help you - link

Or you can use ssh-copy-id user@host as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.