1

I am building a new CentOS 7 to replace an old server, and many SSH clients were setup to trust/recognize the old server using the certificate of the server (presented by SSHD)

Is it possible to move the old SSHD certificate from the old server to the new server so all clients will immediately recognize and trust the new server?

Improve this question
3
  • 1
    assuming that the new server will have the same identification (hostname, IP address) to match the keys.
    – user4556274
    Jan 3, 2017 at 17:36
  • So the IP address and hostname are incorporated into the key? (I didn't know that) - I was planning to use a different IP which then I could not do
    – TSG
    Jan 3, 2017 at 18:18
  • the IP and/or hostname are not incorporated into the key, but associated with the key. Your client records "I trust this key for this hostname (and IP)" not "I trust this key anytime I will see it."
    – user4556274
    Jan 3, 2017 at 20:06

1 Answer 1

Reset to default
4

The key is in /etc/ssh, should be various ssh_host_* files. If you move those over, then the clients will continue to recognize it (presuming, as user4556274 points out, the host name clients use to connect matches).

Also: You may want to confirm the keys' continued adequacy, e.g., if they're long enough (bits) to still be secure enough and also review the OpenSSH news and/or ssh-keygen manpage to see if you want to generate additional keys (e.g., for new crypto algorithms). For example, according to some recommendations RSA and DSA keys should be at least 3072 bits. An old machine probably doesn't have ECC keys (but you should consider generating some).

[I don't know how to upgrade keys on existing clients without getting the key changed warning, so I've asked: How to roll over ssh host keys? ]

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.