Is there an easy way to generate hashed hostnames to be added to the ~/.ssh/known_hosts file?

I'd like to add a @cert-authority line to the ~/.ssh/known_hosts file.

Obviously the ssh-keygen command would not get the CA cert.  I think it also needs a connection to the server, and I'm not sure I can get it to hash a wildcard.

So, how would I hash "*.bar.com", for example, so that it can be used in the ~/.ssh/known_hosts file?

Edit: Having thought about it, hashed wildcards probably can't work, as it would be too difficult for the client to match a wildcard after it has been hashed. But, if I can still get a method to hash a domain without requiring a connection to the server (as ssh-keygen does), that would be great.

1 Answer 1


If you want to change the hostname for an existing hashed host, edit your known_hosts file, replacing the hashed hostname with the plaintext hostname you wish associated with that key, and rehash the file:

ssh-keygen -H

If you want to generate hashes for a list of hostnames without disturbing your known_hosts, create a file combining the hostnames you wish to hash with a valid key copied out of an existing known_hosts :

sample.bar.com ecdsa-sha2-nistp256 AAAAE2...
other.bar.com ecdsa-sha2-nistp256 AAAAE2...
diff.domain.org ecdsa-sha2-nistp256 AAAAE2...

Then hash this file using ssh-keygen :

ssh-keygen -f mytestfile -H

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .