Bash script to rekey a server (untested)

rekey.sh

#!/bin/bash

set -e

hostname
archive_dir="/etc/ssh/compromised_keys/$(date +%F)"
mkdir -p $archive_dir

mv /etc/ssh/ssh*_key $archive_dir
mv /etc/ssh/ssh*_key.pub $archive_dir

ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa >> $archive_dir/regen_log
ssh-keygen -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa >> $archive_dir/regen_log
ssh-keygen -f /etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa >> $archive_dir/regen_log

ssh-keygen -lf /etc/ssh/ssh_host_rsa_key
ssh-keygen -lf /etc/ssh/ssh_host_dsa_key
ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key