207

I've created an RSA keypair that I used for SSH, and it includes my email address. (At the end of the public key.)

I've now changed my email address.

Is it possible to change the email address on the key, or is it part of the key and I would have to make a new one?

3 Answers 3

245

I've created an RSA keypair that I used for SSH, and it includes my email address. (At the end of the public key.)

That part of an ssh key is just a comment. You can change it to anything you want at any time. It doesn't even need to be the same on different servers. You can remove it as well. It is only there to help you or someone else figure out what to delete when you have many keys in an authorized_keys file and you need to revoke or change one of them.

ssh-rsa AAAAB3N....NMqKM= this_is_a_comment

When I create my keys with ssh-keygen I usually use a command like this to set a different comment. I don't think the username@host is very useful. You can certainly put it whatever comment that you like that will be useful to you and any other admins to help identify who the key belongs to.

ssh-keygen ... -C YYYYMMDD_surname_givenname
5
  • 15
    So happy I don't have to change my keys...
    – Ram Rachum
    Sep 7, 2011 at 23:33
  • I'm happy to realize I don't need to use my email address. Any idea why you'd want to add a comment to the key? Maybe I could just get away with the site it's used on instead of my email. Sep 5, 2014 at 1:10
  • Well I want (require) comments on my systems because there are 8 network techs and a large number of systems that use key for automated tasks. My typical authorized_keys file has like 10-15 keys in it. Comments are there to people recognize what each key belongs to. Anyway the comments are there to make keys easier to manage. You can use them however you like.
    – Zoredache
    Sep 5, 2014 at 1:14
  • 2
    Since comments are always the last item in an authorized_keys file, spaces are allowed, so you don't need to use underscores.
    – IQAndreas
    Dec 8, 2015 at 16:12
  • @IQAndreas you are right of course, but I also use that comment in a couple other places where it does matter. For example I have the name of my comment be the same as the filename of my key as it is stored in my /.ssh dir. I know spaces are allowed in files too, but not using them makes it easier to reference my file from the cli.
    – Zoredache
    Dec 8, 2015 at 17:39
43

You can change the comment for RSA1 keys using ssh-keygen -c.

from the ssh-keygen manpage:

 -c      Requests changing the comment in the private and public

key files. This operation is only supported for RSA1 keys. The program will prompt for the file containing the private keys, for the passphrase if the key has one, and for the new comment.

So, to change the comment of a key located at ~/.ssh/some_key, use the following command:

ssh-keygen -c -f ~/.ssh/some_key -C "my new comment"

Where the -f option is followed by the key you want to change, and -C is followed by the new comment.

2
  • 7
    ssh-keygen -c -f id_foo returns Comments are only supported for RSA1 keys. Jul 2, 2015 at 22:29
  • +1, this works with OpenSSH ed25519 keys, too. ed25519 keys are completely Base64 encoded. The comment cannot be stripped with a text editor.
    – user145545
    Apr 9, 2018 at 5:03
26

From OpenSSH 6.5 onwards, works with all key types, not just RSA1:

ssh-keygen -f ~/.ssh/keyfilename -o -c -C "here goes your comment"

Command options explained:

  • -f: private key file
  • -o: convert the private key from PEM to the new OpenSSH format
  • -c: change the comment in the private and public key files
  • -C: comment text

See also: ssh-keygen(1) man page (current)

1
  • 1
    Thank you @AntoineCotten - will use your edit as a reference for future answers. :-) Jun 2, 2018 at 14:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .