I have multiple GPG keys. One of them I use on daily basis, signing commits, e-mails and such, it is on my computers and ready at hand. I have a different key that I consider more trustworthy, I use it to encrypt confidential information, it is offline in Yubikey and I have to plug it in whenever I want to use it.

For both of those keys I have authentication subkeys. Again, divided by trustworthiness. I can use my "on computer" key to push to github, but to login to my salt-master, I need the offline key.

Now, what I'm struggling with is that I would like to have on most of my servers possibility to use both - just in case if I would loose the less trustworthy key and sometimes I need to access the same server using multiple keys. Like gitolite admin vs user.

Now my problem is I don't know which key ssh picks to try first, so sometimes I'm asked to insert Yubikey when pushing, but more importantly, I haven't figured out how to handle Gitolite usecase.

I can put into my .ssh/config different Host entries for the same server, same user just different key and that works great if using ssh keys that are located somewhere on the disk, but can't figure out how to enter there specific gpg key provided by gpg-agent. Is there some solution, or do I have no other choice but to revert back to using ssh keys?

  • Run your ssh with -vvv to get verbose output. In that output it should give information about what methods of authentication it is using and the specific keys chosen. ssh -vvv username@hostname
    – Natolio
    Commented Apr 8, 2021 at 14:24
  • Yes, that told me: Server accepts key: (none) ED25519 SHA256:X............U agent But unfortunately I still have no idea how to enter it into Host section in .ssh/config.
    – Miška
    Commented Apr 9, 2021 at 12:16

1 Answer 1


On ~/.ssh/config file, Add a public key instead private. You can make a public key by gpg --export-ssh-key. SSH will try all key that listed on ssh-add -l, and it will pick a first key. You can check a log using -vT option.

Export your authentication flag toggled gpg key

Match host company.github.com exec CMD
    Hostname github.com
    IdentityFile ~/.ssh/company.pub

Match host my.github.com exec CMD
    Hostname github.com
    IdentityFile ~/.ssh/me.pub
  • How does substituting a public key for a private one help? Commented Aug 11, 2022 at 21:15
  • Well. In my case, I have a two personal account on github.
    – jisu choi
    Commented Aug 12, 2022 at 5:19
  • I wanted to make my gpg replace all related on authentication such as code server ssh connection and git clone. This can be done just simply add a gpg keygrip on sshcontrol file. But same domain, different account using different key configuration not work because agent always tried authentication only first record on the ssh control file. When using ssh key, i can specify certain key using IdentityFile option but in case of gpg, it doesn't have private key in ssh form. So, instead of private key, using public key make do the trick
    – jisu choi
    Commented Aug 12, 2022 at 5:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .