How do I revoke a lost or exposed SSH private key?
Revocation happens where the public key is authorised, not by deleting your local private-key file. Use a verified alternate administrator session or recovery console to remove the affected public identity from every relevant account and managed access source.
Instructions
1. Identify the compromised identity
If you still have its public file, record the fingerprint. Do not share the exposed private material while reporting the incident.
ssh-keygen -lf "$env:USERPROFILE\.ssh\server_ed25519.pub"The public fingerprint lets administrators locate the exact authorised entry.
2. Inspect the account’s key inventory
Use trusted alternate access. For a standard Linux account, compare the enrolled fingerprints.
ssh-keygen -lf "$HOME/.ssh/authorized_keys"This reads the current account’s public-key inventory. Other accounts and centrally managed sources require separate review.
3. Remove the affected identity and verify containment
Enrol a new key if access must continue, then remove only the matching public entry through the approved management path. Review active sessions and authentication logs: removing a public key prevents new key authentication but does not automatically terminate existing sessions. Rotate any other credentials that the compromised access could have exposed.
Check the result
- The replacement or alternate identity works.
- A new login using the revoked key is rejected on every affected account.
Troubleshooting
- No alternate login remains
- Use the provider’s authenticated recovery console or authorised support process.
- The old key remains usable
- Check for another enrolled copy, managed access backend or SSH certificate authority that still authorises it.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.