I seem to be not able to generate a RSA-4096 SSH key in OpenSSH's new key format with the following command:

$ ssh-keygen \
  -f rsa4096_key \
  -t rsa \
  -b 4096 \
  -C 'This is a test' \
  -o \
  -N ''

At least I get the following error message after trying to change the existing comment of the RSA-4096 SSH key:

$ ssh-keygen -cf rsa4096_key
Comments are only supported for keys stored in the new format (-o).

So even though I specified the -o flag during key generation the RSA-4096 SSH key seems to be written in the old PEM key format instead of OpenSSH's new key format.

N.B. For an Ed25519 SSH key I'm able to retroactively change its comment.

According to the manpage SSH-KEYGEN(1) of OpenSSH version OpenSSH_7.7p1:

-o Causes ssh-keygen to save private keys using the new OpenSSH format rather than the more compatible PEM format. The new format has increased resistance to brute-force password cracking but is not supported by versions of OpenSSH prior to 6.5. Ed25519 keys always use the new private key format.

Does someone has a solution to this problem or can tell me what I did wrong? Thanks!

Update: The solution proposed by @slm works for me albeit the misleading manpage and confusing console output. Basically the command:

$ ssh-keygen -f rsa4096_key -o -c -C 'here goes your comment'
Key now has comment 'This is a test'
The comment in your key file has been changed.

When run again it proves that it changed the comment to the one given on the previous command line:

$ ssh-keygen -f rsa4096_key -o -c -C 'Hello World!'
Key now has comment 'here goes your comment'
The comment in your key file has been changed.

Therefore I accepted @slm's answer.

  • What version of OpenSSH is this?
    – slm
    Jul 8, 2018 at 23:05
  • 1
    The version of OpenSSH with which I ran the commands above is OpenSSH_7.7p1.
    – Tim Friske
    Jul 9, 2018 at 18:31

1 Answer 1


I think this is a bug in both the -o switches behavior as well as a documentation bug in OpenSSH.

This works for me:

$ ssh-keygen \
  -f rsa4096_key \
  -t rsa \
  -b 4096 \
  -C 'This is a test' \
  -o \
  -N ''

$ grep -o "This.*" rsa4096_key.pub
This is a test

So the comment is getting stored in the rsa4096_key.pub file. Since the .pub file can always be extracted from the private key, it's by definition in the private key file as well.

This SU Q&A titled: How can I change the comment field of an RSA key (SSH)? shows some analysis around this. Also there's a comment on this SF Q&A titled: Possible to change email address in keypair?.


From OpenSSH 6.5 onwards, works with all key types, not just RSA1:

ssh-keygen -f ~/.ssh/keyfilename -o -c -C "here goes your comment"
  • -f: private key file
  • -o: convert the private key from PEM to the new OpenSSH format
  • -c: change the comment in the private and public key files
  • -C: comment text

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.