Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a technical reason why IOS requires the device's domain-name to be set (via ip domain-name) before an SSH key can be generated? Is the domain-name used in any way in the generation of the key?

Is there any way to force the generation of a key before the domain name is set?

UPDATE: Myself (before I posted this question) and others in your answer seem to think it may be used as either a salt or a source of entropy for the key. Wouldn't the domain-name be very predictable? This doesn't seem like a suitable source of entropy.

share|improve this question

migrated from Aug 7 '11 at 21:43

This question came from our site for professional and enthusiast programmers.

up vote 8 down vote accepted

You do not need to set "ip domain-name" or "hostname" before creating a key. They are required if you don't name it yourself. Use the following command to name it yourself:

 crypto key generate rsa general-keys label MYKEYNAME

More info here:

share|improve this answer

Sorry Julian but Joseph is right

Before issuing this command, ensure your router has a host name and IP domain name configured (with the hostname and ip domain-name commands). You will be unable to complete the crypto key generate rsa command without a host name and IP domain name. (This is not true only when you generate a named-key-pair.)

source: under the command reference section

share|improve this answer

It almost certainly uses the domain name as a salt in the key.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.