Documentation
Keys & identities
How Termiyo holds your keys, where the private half lives, and how certificates and agents fit in.
Identities reuse a key
One login, many hosts
An identity pairs a username with how to authenticate. Point it at a key once and every host that uses the identity authenticates with that key — there is no need to attach the key host by host.
Generate or import a key
Generate on this machine
Settings, SSH keys, Generate a new key. Termiyo makes the keypair on this computer and stores it in the vault. Only its public line comes back to the screen — the private half never leaves the main process.
Import a key file
Import from a file, or paste a private key. A passphrase-protected key asks for its passphrase; you can save that in the vault so you are not asked again. A PuTTY .ppk is converted to OpenSSH on import.
Rotation reminder
Set a reminder in days and Termiyo flags a key once it is older than that, so you can generate a fresh one and replace it on your hosts before it goes stale.
Agents and hardware tokens
A key held elsewhere
A key can live on a hardware token or in an SSH agent rather than in the vault. Termiyo keeps only the public half and asks the agent or token to sign; the private half never leaves it.
What the agent is asked
Termiyo asks your agent what it holds before it connects, so a key — or a certificate — the agent carries is offered without anything to paste.
SSH certificates
Paste the certificate
Open Settings, SSH keys, pick the key and paste the -cert.pub line your certificate authority signed. Termiyo shows whom it lets in, until when, and any command it forces, and the key list shows when it runs out. It refuses a host certificate, and one signed for another key, whenever it can tell which key this is.
Imports bring them along
Importing an ssh_config brings each key’s CertificateFile and the -cert.pub beside it, and so does choosing a key file. A certificate for the wrong key, a host certificate or an expired one is not attached, and the preview says why.
Mosh too
A Mosh host logs in with your certificate the way an SSH host does. Security-key certificates are left out of a Mosh login, because it cannot wait for a touch — use SSH for those.