How to fix ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519 in SSH

SSHBEGINNERLOWUpdated Jan 4, 2026· 234 views

SSH automatically generates host keys when the SSH server starts for the first time. This message is normal and expected on new systems or fresh containers, but can be concerning if it happens unexpectedly on an existing server.

Quick fix

Fixes ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519

# The SSH daemon will auto-generate keys at:
/etc/ssh/ssh_host_rsa_key
/etc/ssh/ssh_host_ecdsa_key
/etc/ssh/ssh_host_ed25519_key
  1. Let SSH automatically generate missing host keys
  2. Verify host keys were generated successfully
  3. Manually generate missing host keys if needed
  4. Restart SSH daemon to apply changes
ssh — error
# The SSH daemon will auto-generate keys at:
/etc/ssh/ssh_host_rsa_key
/etc/ssh/ssh_host_ecdsa_key
/etc/ssh/ssh_host_ed25519_key
ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519

What this error means

When you see "ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519," SSH is creating cryptographic key pairs that uniquely identify your server. Host keys are used to: 1. **Authenticate the server** - Prove that the server is who it claims to be when clients connect 2. **Prevent man-in-the-middle attacks** - Clients can verify they're connecting to the legitimate server by checking the stored host key 3. **Encrypt initial connections** - These keys are used before user authentication begins The message lists the key types being generated: RSA (older but widely supported), DSA (deprecated), ECDSA (elliptic curve), and ED25519 (modern, recommended). Each key type is generated as a pair: a private key (kept secret on the server) and a public key (shared with clients).

Typical symptoms

  • Message appears when starting SSH daemon or during first boot of a new system
  • SSH keys are missing from /etc/ssh/ directory
  • System is a fresh Docker container, VM, or newly provisioned machine
  • SSH service fails to start because host keys don't exist
  • Client shows "Host key is unknown" warning on first connection

Common causes

  1. SSH daemon starting for the first time on a new system
  2. Host keys were deleted from /etc/ssh/ directory
  3. SSH was recently installed and auto-generation is enabled
  4. System image (Docker, VM) shipped without pre-generated host keys for security reasons
  5. SSH daemon reconfigured to regenerate missing keys on startup

How to fix "ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519"

1Let SSH automatically generate missing host keys

This is the default and recommended behavior. SSH will automatically create the necessary key files on first startup:

bash
# The SSH daemon will auto-generate keys at:
/etc/ssh/ssh_host_rsa_key
/etc/ssh/ssh_host_ecdsa_key
/etc/ssh/ssh_host_ed25519_key

This happens automatically and is safe. The keys are unique to your server and stored securely. Clients will cache the public key in their ~/.ssh/known_hosts file after the first connection.

2Verify host keys were generated successfully

After SSH starts, check that the host keys exist:

bash
ls -la /etc/ssh/ssh_host_*key

You should see several files:
- ssh_host_rsa_key and ssh_host_rsa_key.pub
- ssh_host_ecdsa_key and ssh_host_ecdsa_key.pub
- ssh_host_ed25519_key and ssh_host_ed25519_key.pub

The private keys should have permissions 600 (readable/writable by root only).

3Manually generate missing host keys if needed

If auto-generation didn't work, you can manually generate them with ssh-keygen -A (which only creates missing keys):

bash
sudo ssh-keygen -A

Or generate specific key types manually:

bash
# Generate RSA key (4096-bit)
sudo ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""

# Generate ECDSA key
sudo ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ""

# Generate ED25519 key (recommended, modern)
sudo ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""

The -N "" flag sets an empty passphrase (required for host keys).

4Restart SSH daemon to apply changes

After generating keys, restart the SSH service:

bash
# On systemd systems (Ubuntu, Debian, RHEL)
sudo systemctl restart ssh
# or
sudo systemctl restart sshd

# On older systems
sudo service ssh restart
# or
sudo service sshd restart

Verify it's running:

bash
sudo systemctl status ssh

Advanced notes

Key Type Recommendations:
- ED25519: Most recommended for new deployments. Fastest, most secure, smallest key size, resistant to all known attacks.
- ECDSA: Good alternative with elliptic curve cryptography if ED25519 isn't available.
- RSA: Still widely supported. Use 4096-bit keys if you must use RSA; 2048-bit is no longer considered adequately secure.
- DSA: Deprecated and disabled in newer OpenSSH versions. Do not use.

Docker/Container Note: If you're building Docker images, it's a security risk to pre-generate SSH host keys in the image—all containers from that image would share the same keys. Instead, generate keys at container startup using an entrypoint script or let the sshd package auto-generate them.

Virtual Machine/Cloud Images: Similar to Docker, VM images should not include pre-generated host keys. They should be generated on first boot to ensure each instance has unique keys.

Regenerating Existing Keys: The command ssh-keygen -A only creates missing keys; it won't overwrite existing ones. To completely regenerate all keys:

bash
sudo rm /etc/ssh/ssh_host_*
sudo ssh-keygen -A

This is useful after cloning VMs or containers, but be aware that clients will see "Host key has changed" warnings because the fingerprint is different.

Frequently asked questions

What does "ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519" mean?
When you see "ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519," SSH is creating cryptographic key pairs that uniquely identify your server. Host keys are used to: 1. Authenticate the server - Prove that the server is who it claims to be when clients connect 2.
How do I fix "ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519"?
SSH automatically generates host keys when the SSH server starts for the first time. This message is normal and expected on new systems or fresh containers, but can be concerning if it happens unexpectedly on an existing server.
What causes "ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519"?
SSH daemon starting for the first time on a new system Host keys were deleted from /etc/ssh/ directory SSH was recently installed and auto-generation is enabled
Is the "ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519" error serious?
It is a low-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading