SSH Key Safety
Create, deploy, verify and rotate SSH authentication keys.
Before you run
Keep private keys and passphrases secret. Protect backups and retain a working administrative login. Do not overwrite an existing key. Test the new key in a separate session before removing the old public key from authorized_keys; certificates and automation may require separate changes.
Server-side steps use Ubuntu as an example. Commands, configuration paths and service names may differ on other systems. Run client-side steps on the client as indicated.
After applying changes, verify that you can sign in and that the intended behavior works in a new SSH session. Keep the current session open until verification succeeds, so you can restore the configuration if necessary.
Examples
On the client, create a dedicated key at an unused path and set a passphrase when prompted.
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_serverCompare the public-key fingerprint and install only the public key for the intended server account. Replace the example host and user.
ssh-keygen -lf ~/.ssh/id_ed25519_server.pub
ssh-copy-id -i ~/.ssh/id_ed25519_server.pub user@example.comTest the new key in a separate session. After successful verification, remove only the obsolete public-key entry from the correct account’s authorized_keys.
ssh -i ~/.ssh/id_ed25519_server user@example.comAuthoritative references
Reviewed October 27, 2026