SSH keys and certificates

This page describes how to manage SSH keys and certificates in Termius, including FIDO2 hardware keys and biometric keys.

Overview

Termius Keychain lets you generate, store, and organize credentials such as usernames, passwords, SSH keys, and certificates. It helps you avoid duplication and manage credentials across multiple servers.

For SSH keys in particular, Termius can:

• Import SSH keys and certificates

• Generate SSH keys, FIDO2 keys, and Biometric keys

• Provide a convenient way to export the public keys to the authorized_keys file on your servers

SSH keys

Termius allows you to import your existing SSH keys and generate a new one using a built-in SSH key generator.

Generate SSH keys

Termius can generate Ed25519, ECDSA, RSA, and ML-DSA keys.

Desktop

To generate SSH keys on the desktop:

1. Navigate to the Keychain screen and select Generate Key at the key drop-down

   
2. Specify a name for the key in the Label field and choose the Key type

   
3. For extra security, set a passphrase. Turn on Save passphrase to avoid passphrase prompts when you connect.

   
4. Click Generate & save

iOS

Android

Import SSH keys

Termius can import SSH keys from a file or by pasting a private key from the clipboard.

Desktop

Paste a key on the desktop

1. Navigate to the Keychain and click Key

   
2. Paste your private key from the clipboard

   
3. Specify a name for the key in the Label field. The key will be auto-saved

Import from a file on the desktop

1. Navigate to the Keychain and click Key

   
2. Drag and drop your key file or click Import from key file

   
3. Specify a name for the key in the Label field. Termius auto-saves the key

If your key is protected with a Passphrase you can specify it in a corresponding field. Otherwise, you will be prompted for a passphrase on every connection.

iOS

Android

Export an SSH key to a server

Termius provides a convenient way to export SSH keys to your servers. When you export a key, its public portion is added to the authorized_keys file on your server.

Upon successful export, the key is linked to the corresponding host in Termius, allowing you to connect with one click.

If you want to link keys to your hosts manually, see SSH with an SSH key.

Desktop

To export SSH keys to a server on the desktop:

1. Navigate to the Keychain and Right-click a key you'd like to export, then click Export to host in the context menu

   
2. Click Select Host and select the host you want the public key to be exported to

   
3. If your authorized keys are stored in a custom directory, update the folder path in the Location field and specify the authorized keys file using the Filename field

4. Click Export and Attach

   

iOS

Android

SSH certificates

To authenticate with an SSH certificate, you need both a private key and a corresponding certificate. Typically, these are stored as two separate files on your file system. Termius stores certificates as part of the SSH key since they won't work without each other.

Import SSH Certificate

Desktop

To import an SSH certificate on the desktop:

1. Navigate to the Keychain and click Certificate

   
2. Paste your private key and certificate into the corresponding fields

   
3. Termius auto-saves them

iOS

Android

Assign an SSH certificate to a host

Desktop

To assign an SSH certificate to a host on the desktop:

1. Navigate to the Hosts screen and open the Host Details for a selected host

   
2. In the Credentials section, click + SSH ID, Key, Certificate, FIDO2 and select Certificate as the authentication method

   
3. Select one of the certificates that you previously saved

   
4. Termius auto-saves the changes

iOS

Android

FIDO2 keys

Hardware keys provide one of the industry's most secure methods for SSH authentication. They're designed to make it impossible to extract private keys and protect them against compromise. Hardware keys can also offer additional security features, such as user-presence confirmation, providing an extra factor during authentication.

Termius simplifies the use of hardware keys for SSH connections, allowing you to generate non-resident FIDO2 keys within the app and syncing it across your devices.

Prerequisites

• You'll need a hardware security key that supports the FIDO2 protocol, such as YubiKey, Solo, OnlyKey, or Google Titan. Most other FIDO2-compatible security keys should also work with Termius

• FIDO2 requires OpenSSH 8.4 or higher to be installed on your server

• Hardware keys usually need to be set up before their first use. Some require a PIN code, while others use a biometric scanner and require you to enroll your fingerprint. Make sure you finish setting up your hardware key before following the steps below

Generate a FIDO2 SSH key

Desktop

To generate a FIDO2 key in Termius on the Desktop:

1. Navigate to the Keychain screen and click FIDO2

   
2. Plug in your hardware key and select it from the device list. Enter a PIN if required

   
3. Adjust optional configuration settings such as Require User Presence or Require PIN code and Passphrase for better security

   
4. Click Generate

Configuration Settings

Require User Presence - when enabled, Termius prompts you to touch the hardware key when logging in to a server. This option is used for 2FA to ensure authentication doesn't occur without your intent.

Require PIN code - when enabled, Termius prompts you to enter the hardware key's PIN code. This option is available only when your hardware key has a PIN code set.

Passphrase provides an additional layer of security. Termius will prompt you for the passphrase on every connection; toggle Save passphrase to avoid passphrase prompts.

iOS

Android

Connect using FIDO2 keys

Desktop

Once the FIDO2 key is generated, make sure to export its public part to the hosts that you want to access with this FIDO2 key, see Export an SSH key to a server.

To connect using a FIDO2 key:

1. Make sure the FIDO2 key is exported to the host

2. Plug in your hardware key

3. Double-click the host to connect

4. During the connection, Termius may prompt you to confirm your presence. Touch your hardware key to confirm

   

iOS

Android

Biometric keys

Biometric SSH Keys are securely stored on your device in a trusted execution environment and protected by biometric authentication. They never leave your device and remain inaccessible to others, even if someone gains unauthorized access to it.

Since the biometric keys are stored in an isolated hardware subsystem, they are not synchronized, as it's impossible to get the contents of the private key parts.

Windows

Windows Hello

Termius for Windows lets you generate Biometric SSH keys within the Trusted Platform Module (TPM). TPM is an isolated hardware subsystem that generates and stores private keys. No one, including Termius or Windows, can export, copy, or access these keys directly.

For SSH connections using such a key, Termius requests TPM to sign the data using the private key. Whenever this happens, Windows prompts you to authorize access to a key stored in TPM with fingerprint authentication.

Generate a biometric Key

1. Navigate to the Keychain screen and click Windows Hello

   
2. Specify the name of the key in the Label field

   
3. Click Generate

Export the biometric key to a host

1. Navigate to the Keychain screen and open the Key Details for a selected key

   
2. Click Export to host , then click Select Host to choose the host you want the public key to be exported to

   
3. If your authorized keys are stored in a custom directory, update the folder path in the Location field and specify the authorized keys file using the Filename field

4. Click Export and Attach

   

Once the key is exported to the host and is attached to the host in Termius, you will be able to use it for connections.

Connect using biometric keys

1. Navigate to the Hosts screen

2. Click the host where you set up biometric keys for authentication

3. Complete the biometric authentication

macOS

iOS/iPadOS

Android