Your browser does not support HTML5 local storage or you have disabled it. Some functionality on this site, including saving your privacy settings and offering you special discounts, uses local storage and may not work with local storage disabled. We recommend allowing the use of local storage in your browser. In some browsers, it is the same setting used for disabling cookies.


Host Key

Enabling Elliptic Curve Host Keys

Add the ECDSA host-key algorithms (remove any key sizes you do not wish to allow) within the <connection> section of your ssh-server-config.xml:

<hostkey-algorithm name="ecdsa-sha2-nistp256" />
<hostkey-algorithm name="ecdsa-sha2-nistp384" />
<hostkey-algorithm name="ecdsa-sha2-nistp521" />
<hostkey-algorithm name="ssh-dss" />
<hostkey-algorithm name="ssh-rsa" />
<hostkey-algorithm name="" />
<hostkey-algorithm name="" />
<hostkey-algorithm name="x509v3-sign-dss" />
<hostkey-algorithm name="x509v3-sign-rsa" />
<hostkey-algorithm name="" />
<hostkey-algorithm name="" />

To enable ECDSA host keys for X.509, add also the following hostkey-algorithm names: x509v3-ecdsa-sha2-nistp256, x509v3-ecdsa-sha2-nistp384, x509v3-ecdsa-sha2-nistp521.

Once the configuration has been amended to use the ECDSA host-key algorithms you can create the ECDSA host key.

Creating ECDSA Host Key

Create the ECDSA host key using ssh-keygen-g3. For more information on ssh-keygen-g3, refer to the Tectia Server Administrator Manual.


You must ensure your SSH client can accept an ECDSA host key.

The following command will add an ECDSA host key to your SSH Server. By default, a 256-bit key is generated. (The -b option can be used to define the size of the key.)

Using ssh-keygen-g3 with –t (type), –H (host key) and –P (no passphrase):

[root@host ~]# ssh-keygen-g3 -t ecdsa -H -P
Generating 256 bits ECDSA key on nistp256 curve

Key generated.
256-bit ecdsa,, Wed Aug 26 2015 10:00:00 +0100
Private key saved to /etc/ssh2/hostkey
Public key saved to /etc/ssh2/

After you have made the changes, you must stop and start the server to take the new configuration into use:

# /etc/init.d/ssh-server-g3 stop
# /etc/init.d/ssh-server-g3 start