# SSH keys

> Cloud Management Platform (CMP) works with two kinds of SSH keys: key pairs discovered in a cloud provider, and global keys added by users

---

Site [llms.txt](/llms.txt)

---

CMP needs the private key material for the key pair a server accepts before it can open an SSH session to that server, whether to provision it, run a remote script, or connect to it later.

## Keys from a resource handler

Several clouds create and hold key pairs, and a server built there accepts the pair it was created with. These resource handlers have an **SSH Keys** tab listing the key pairs CMP found in the provider:

- Alibaba Cloud
- Amazon Web Services
- Azure
- Google Cloud Platform
- MAAS
- OpenStack
- Outscale

CMP reads only the **public** keys from the provider. It can see that a key pair exists, but cannot use it until you supply the private key material.

### Make a key usable

1. Upload or import your public SSH key in the cloud provider's interface.
1. In CMP, open the resource handler and select the **SSH Keys** tab. Keys appear after the handler's sync job completes, and the tab shows a spinner while the job is in progress.
1. Check the **Key Material** column. It says whether CMP already holds the private key material for each key.
1. Select the pencil icon for the key and paste the **private** key material. Saving replaces any material already stored for that key.

## Global SSH keys

To add a global key directly to CMP, go to **Admin** > **SSH Keys**. Global keys are not tied to a resource handler, so a remote script can use one to reach a server on any handler.

Nothing in CMP configures the target server to accept a global key, so authorize it on the server yourself. [Connection Info](/docs/cmp/configure/integrations/connection-info/) records accept only global keys.

## Key material

Paste raw private key material, in either PEM or OpenSSH format. A key protected by a passphrase does not work. CMP checks that a global key is in PEM or OpenSSH format when you save it. It does not check key material uploaded on a resource handler, so a key in the wrong format there fails on first use.

## Choose a key for a server

Set an SSH key as part of the credentials on an existing server, or on an OS build template, where it propagates to every server provisioned from that template. The keys offered are the global keys plus any resource handler keys that have material available and are associated with the environment being deployed to.

Windows servers and VMware servers configured to run their scripts through VMware Tools do not use SSH keys. They authenticate with a username and password.

A global key can be set for an individual remote script action on the action's details page. When the script runs, it overrides any key set on the server.

## Related

- [Resource handlers](/docs/cmp/configure/infrastructure/resource-handlers/): configuring the connection whose key pairs appear on the SSH Keys tab.
- [Connection Info](/docs/cmp/configure/integrations/connection-info/): storing credentials for an external system, including a global SSH key.