Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an entry from an OpenSSH known_hosts file; I'd like to generate an SSHFP resource record for this. I can use ssh-keygen to generate the fingerprint with no difficulty:

$ ssh-keygen -f foo_known_host -l
1040 09:a0:5c:5f:43:fb:e5:25:d8:0c:d8:dc:d7:7a:c4:62 (RSA)

But it doesn't seem to like it for a DNS fingerprint record:

$  ssh-keygen -f foo_known_host -r foo
failed to read v2 public key from foo_known_host.

So how do I do this?

share|improve this question

ssh-keygen(1) doesn't behave the same way as sshfp(1).

You'll note from the man page that the syntax is:

ssh-keygen -r hostname [-f input_keyfile] [-g]

So the file should be an input_keyfile rather than a known_hosts_file. If you don't specify then it will default to the server's local keys of /etc/ssh/ and /etc/ssh/

You can either generate the record from each server that you wish to create SSHFP records for with ssh-keygen. Or source sshfp and create them all from one known_hosts file.

share|improve this answer

This script is good:

It needs to be run in /etc/ssh, or edit it to cd there before it does it's stuff.

share|improve this answer

try -r $HOSTNAME as first arguement:

$ ssh-keygen -r moppel -f ~/.ssh/id_dsa -g
moppel IN TYPE44 \# 22 02 01 3950bf0c2cf2318b9ab2187992b6f7869947c3aa
share|improve this answer
No, switching around the arguments doesn't work. You got probably got correct output because you gave it a v2 public key file, not a known_hosts file with one entry. – Curt Sampson Jul 7 '09 at 10:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.