6

I have an SSH key generated using Putty. The commen section has the creation date "rsa-key-20201015" How can I add an expiration date for an rsa SSH key? Can it be done by editing the comment section?

Improve this question

1 Answer 1

Reset to default
10

There is no place to embed the expiry date within the key itself. Its comment field is really just a comment field and will be ignored by the server – PuTTYgen only adds the date for your own information, it does not act as "issuance date".

However, if the server is running OpenSSH v7.7 or later, then expiry date can be specified for a specific authorized_keys entry instead:

expiry-time="YYYYMMDD" ssh-rsa AAAAB3Nz...w== Some comment

You can also specify exact time using YYYYMMDDhhmm (the default is midnight 00:00). For example, if you specify 20201030, the entry will stop being accepted at 2020-10-30 00:00:00.

(Note that the actual key does not change at all – it's still in the same format and it still doesn't have any expiry date "built in", only the authorized_keys file does.)

Older systems do not support this feature, and would need manual cron scripting via the comment field. For reference:

  • Debian 10 (Buster) and Ubuntu 18.04 (Bionic) have OpenSSH v7.9 and support this feature.
  • Debian 9 (Stretch) and Ubuntu 16.04 (Xenial) have OpenSSH v7.2/v7.4 and do not support it.

OpenSSH also has a different key format (known as "SSH certificates") which does allow embedding expiry date. However, certificates cannot be used with PuTTY, WinSCP, or Bitvise clients – they're only compatible with OpenSSH itself (i.e. the ssh client). More documentation about this functionality: https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Certificate-based_Authentication

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .