I have an entry from an OpenSSH known_hosts file; I'd like to generate an SSHFP resource record for this. I can use ssh-keygen to generate the fingerprint with no difficulty:

$ ssh-keygen -f foo_known_host -l
1040 09:a0:5c:5f:43:fb:e5:25:d8:0c:d8:dc:d7:7a:c4:62 foo.example.com. (RSA)

But it doesn't seem to like it for a DNS fingerprint record:

$  ssh-keygen -f foo_known_host -r foo
failed to read v2 public key from foo_known_host.

So how do I do this?

ssh-keygen(1) doesn't behave the same way as sshfp(1).

You'll note from the man page that the syntax is:

ssh-keygen -r hostname [-f input_keyfile] [-g]

So the file should be an input_keyfile rather than a known_hosts_file. If you don't specify then it will default to the server's local keys of /etc/ssh/ssh_host_rsa_key.pub and /etc/ssh/ssh_host_dsa_key.pub.

You can either generate the record from each server that you wish to create SSHFP records for with ssh-keygen. Or source sshfp and create them all from one known_hosts file.

This script is good:


It needs to be run in /etc/ssh, or edit it to cd there before it does it's stuff.

try -r $HOSTNAME as first arguement:

$ ssh-keygen -r moppel -f ~/.ssh/id_dsa -g
moppel IN TYPE44 \# 22 02 01 3950bf0c2cf2318b9ab2187992b6f7869947c3aa
  • 1
    No, switching around the arguments doesn't work. You got probably got correct output because you gave it a v2 public key file, not a known_hosts file with one entry. – Curt J. Sampson Jul 7 '09 at 10:48

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.