DEV Community

Cover image for How to set up SSH keys for signed commits
supriya
supriya

Posted on

How to set up SSH keys for signed commits

#git #beginners #programming #devops

SSH keys are used to access and write data into your GitHub repository. Whenever you connect via SSH, you authenticate using the private key file on your local machine.

Before creating a new key, check if you already have one:

# on linux
ls ~/.ssh

# on Windows
ls c:/Users/<your name>/.ssh
Enter fullscreen mode Exit fullscreen mode

Look for files like:

id_rsa  id_rsa.pub  or  id_ed25519  id_ed25519.pub
Enter fullscreen mode Exit fullscreen mode

1. Create your SSH key

You can generate your SSH key pair using ssh-keygen. Many algorithms generate an SSH key pair. Here, we specify the Ed25519 algorithm using the -t flag. The -C flag allows us to add a comment to identify the key and is optional.

ssh-keygen -t ed25519 -C "[email protected]"
Enter fullscreen mode Exit fullscreen mode

This generates an SSH key pair (public and private keys) in the c:/Users/<yourName>/.ssh folder on Windows.

Your key pair is saved as:

c:/Users/<yourName>/.ssh/id_ed25519 (private)

c:/Users/<yourName>/.ssh/id_ed25519.pub (public)

On Linux, this is usually: ~/.ssh/. Listing the files in the folder shows two files.

ls
Enter fullscreen mode Exit fullscreen mode 

id_ed25519  id_ed25519.pub
Enter fullscreen mode Exit fullscreen mode

2. Add the SSH Key to the SSH Agent 

eval $(ssh-agent -s)

# on Linux
ssh-add ~/.ssh/id_ed25519

# on Windows
ssh-add /c/Users/<yourName>/.ssh/id_ed25519
Enter fullscreen mode Exit fullscreen mode

3. Copy the public key

cat shows the file's content. The pipe (|) operator feeds this content as input to the clip command. This copies the file content to your clipboard.

cat ~/.ssh/id_ed25519.pub | clip
Enter fullscreen mode Exit fullscreen mode

4. Add the public key to your GitHub account

Go to GitHub → Profile Icon → Settings.

Navigate to SSH and GPG keys

Click New SSH key

Give it a title (e.g., “Laptop - June 2025”) and paste the key

Image showing the user setting on GitHub under profile section.

Image showing the SSH and GPG keys in the User settings

Image which shows a button to create a new SSH key on GitHub

Since we are using this key to sign our commits, make sure you change the "Key type" to Signing key.

Image that shows details to create a new SSH key in GitHub. Make sure you select this as Signing key

5. Testing your SSH connection 

ssh -T [email protected]
Enter fullscreen mode Exit fullscreen mode

You should see something like this after you enter your passphrase (if you configured it while generating the SSH key pair).

Image showing the authenticated state

If you also want to authenticate repositories with this SSH key, add the same public key again as an Authentication key under SSH and GPG keys → New SSH Key → Change "Key Type" to Authentication key.

6. Use SSH for Your Repo Remote (optional)

If your repo was cloned using HTTPS, you'll need to switch to SSH to use this key to push changes.

git remote set-url origin [email protected]:yourusername/yourrepo.git
Enter fullscreen mode Exit fullscreen mode

7. Signing commits

Enable commit signing and specify SSH key format

git config commit.gpgsign true

# or enable it globally

git config --global commit.gpgsign true
Enter fullscreen mode Exit fullscreen mode

Configure Git to use SSH to sign commits and tags:

git config --global gpg.format ssh
Enter fullscreen mode Exit fullscreen mode

To set your SSH signing key in Git, paste the text below, substituting /PATH/TO/.SSH/KEY.PUB with the path to the public key you'd like to use.

git config --global user.signingkey /PATH/TO/.SSH/KEY.PUB
Enter fullscreen mode Exit fullscreen mode

8. Check for verification on your new commit

When committing changes in your local branch, add the -S flag to the git commit command.

git commit -S -m "YOUR_COMMIT_MESSAGE"
# Creates a signed commit
Enter fullscreen mode Exit fullscreen mode

If you configured a passphrase while setting up the SSH key, provide it. Otherwise, leave it blank.

Now, visit the commits in your repository to check the verified status.

Image showing the verified tag in the commit, after configuring SSH key

Resources:

Top comments (2)

Collapse
 
samurai71 profile image
Mark Landeryou •

Thank you for this great article I see where I made a mistake and now know how to fix it

Collapse
 
supriya-kotturu profile image
supriya •

Thanks!

Some comments may only be visible to logged-in visitors. Sign in to view all comments.