5

When viewing Deploy Keys in a GitLab repository's setting, the keys have a "name" and also some kind of fingerprint. The fingerprint looks like this:

2b:be:a7:7f:44:64:89:8d:e3:f7:ea:3c:12:c9:e5:e7

I am trying to find out which of my ssh key-pairs this one corresponds to. How do I compute this string from an existing ssh key-pair?

rlandster
  • 1,522

1 Answers1

12

SSH key fingerprints are simply hashes of entire public-key block (the large AAAA...= blob in your id_rsa.pub). First Base64-decode that field, then compute its MD5 or SHA256 hash, finally print it in hex (for MD5) or Base64 (for SHA256).

You can compute the fingerprints manually...

cat id_rsa.pub | awk '{print $2}' | base64 -d | md5sum

cat id_rsa.pub | awk '{print $2}' | base64 -d | openssl dgst -md5 -c


awk '{print $2}' id_rsa.pub | base64 -d | openssl dgst -sha256 -binary | base64

...or ask OpenSSH to do it (more convenient because it'll accept private key files too):

ssh-keygen -l -f <keyfile>

Newer OpenSSH versions instead use a SHA256 hash and encode the fingerprint to Base64, not hex. To force a new OpenSSH ssh-keygen to show you the MD5 fingerprint, just add -E md5:

ssh-keygen -l -f <keyfile> -E md5
grawity
  • 501,077