Is there an easy way to generate hashed hostnames to be added to known_hosts?

I'd like to add an @cert-authority line to the known_hosts file.

Obviously ssh-keygen would not get the CA cert, I think it also needs a connection to the server, and I'm not sure I can get it to hash a wildcard.

So, how would I hash "*.bar.com" for example, so that it can be used in the known_hosts file?

Edit: Having thought about it, hashed wildcards probably can't work, as it would be too difficult for the client to match a wildcard after it has been hashed. But, if I can still get a method to hash a domain without requiring a connection to the server (as ssh-keygen does), that would be great.


If you want to change the hostname for an existing hashed host, edit your known_hosts file, replacing the hashed hostname with the plaintext hostname you wish associated with that key, and rehash the file:

ssh-keygen -H

If you want to generate hashes for a list of hostnames without disturbing your known_hosts, create a file combining the hostnames you wish to hash with a valid key copied out of an existing known_hosts :

sample.bar.com ecdsa-sha2-nistp256 AAAAE2...
other.bar.com ecdsa-sha2-nistp256 AAAAE2...
diff.domain.org ecdsa-sha2-nistp256 AAAAE2...

Then hash this file using ssh-keygen :

ssh-keygen -f mytestfile -H
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.