Skip to content

README.md: add some docs about key file passphrases #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
creachadair merged 1 commit into from
Jun 7, 2026
+19 −0
Merged

README.md: add some docs about key file passphrases #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,13 @@ The agent loads all the secrets matching the specified name prefix once at
startup. The value of each secret must be a PEM-formatted private key. The
agent logs and ignores any secrets that do not have this format.

> [!NOTE]
> Because `tskagent` gets its keys from setec, and does not have any way to
> prompt a user for a passphrase, the keys stored in setec must not have a
> passphrase set. If you are generating a key with `ssh-keygen`, for example,
> use `-N ''` to specify that no passphrase should be required, or enter an
> empty line when prompted.

By default, keys are loaded from setec only once when the agent starts up.
Use `--update` to make it poll at the specified interval for new secret
versions.
Expand All @@ -48,3 +55,15 @@ but note that this only affects the agent's copy, it does not remove the key
from setec.

[setec]: https://github.com/tailscale/setec

### Example: Generate and Install a Key

Here is an example of how to generate and upload a private key using
`ssh-keygen` and the `setec` command-line tool:

```shell
# Note: Use -N '' to specify an empty passphrase.
% ssh-keygen -N '' -C 'Deploy production services' -t ed25519 -f deploy-access.key

% setec put prod/example/ssh-keys/deploy-access --from-file deploy-access.key --verbatim
```
Loading