Add --kty and --crv/--curve support to 'step ssh rekey'

Author: PHSplineCreated Jul 6, 2026Updated Jul 6, 2026
Labelsenhancementneeds triage

Hello!

  • Vote on this issue by adding a reaction
  • If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Currently, step ssh rekey outputs an ECDSA key and there doesn't appear to be a way to specify --kty / --curve like with step ssh certificate or step ca rekey.

Why is this needed?

For consistency with the other commands that got updated as part of https://github.com/smallstep/cli/issues/477.