I have an SSH key generated using Putty. The commen section has the creation date "rsa-key-20201015" How can I add an expiration date for an rsa SSH key? Can it be done by editing the comment section?
There is no place to embed the expiry date within the key itself. Its comment field is really just a comment field and will be ignored by the server – PuTTYgen only adds the date for your own information, it does not act as "issuance date".
However, if the server is running OpenSSH v7.7 or later, then expiry date can be specified for a specific
authorized_keys entry instead:
expiry-time="YYYYMMDD" ssh-rsa AAAAB3Nz...w== Some comment
You can also specify exact time using
YYYYMMDDhhmm (the default is midnight 00:00). For example, if you specify
20201030, the entry will stop being accepted at 2020-10-30 00:00:00.
(Note that the actual key does not change at all – it's still in the same format and it still doesn't have any expiry date "built in", only the
authorized_keys file does.)
Older systems do not support this feature, and would need manual cron scripting via the comment field. For reference:
- Debian 10 (Buster) and Ubuntu 18.04 (Bionic) have OpenSSH v7.9 and support this feature.
- Debian 9 (Stretch) and Ubuntu 16.04 (Xenial) have OpenSSH v7.2/v7.4 and do not support it.
OpenSSH also has a different key format (known as "SSH certificates") which does allow embedding expiry date. However, certificates cannot be used with PuTTY, WinSCP, or Bitvise clients – they're only compatible with OpenSSH itself (i.e. the
ssh client). More documentation about this functionality: https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Certificate-based_Authentication