When I import my OpenSSH public key into AWS EC2's keyring the fingerprint that AWS shows doesn't match what I see from:

ssh-keygen -l -f my_key

It is a different length and has different bytes.

Why? I'm sure I uploaded the correct key.

up vote 89 down vote accepted

AWS EC2 shows the SSH2 fingerprint, not the OpenSSH fingerprint everyone expects. It doesn't say this in the UI.

It also shows two completely different kinds of fingerprints depending on whether the key was generated on AWS and downloaded, or whether you uploaded your own public key.

Fingerprints generated with

ssh-keygen -l -f id_rsa

will not match what EC2 shows. You can either use the AWS API tools to generate a fingerprint with the ec2-fingerprint-key command, or use OpenSSL to do it.

Note that if you originally generated a key on AWS, but then uploaded it again (say, to another region) then you'll get a different fingerprint because it'll take the SSH2 RSA fingerprint, rather than the sha1 it shows for keys you generated on AWS.

Fun, hey? This screenshot has two copies of the same key in it with different fingerprints

In the above, test-generated was generated using AWS EC2. test-generated-reuploaded is the public key from the private key AWS generated, extracted with ssh-keygen -y and uploaded again. The third key, test-uploaded, is a locally generated key ... but the local ssh-keygen -l fingerprint is b2:2c:86:d6:1e:58:c0:b0:15:97:ab:9b:93:e7:4e:ea.

$ ssh-keygen -l -f theprivatekey
2048 b2:2c:86:d6:1e:58:c0:b0:15:97:ab:9b:93:e7:4e:ea
$ openssl pkey -in theprivatekey -pubout -outform DER | openssl md5 -c
Enter pass phrase for id_landp:
(stdin)= 91:bc:58:1f:ea:5d:51:2d:83:d3:6b:d7:6d:63:06:d2

Keys generated locally

You can use OpenSSL, as demonstrated by Daniel on the AWS forums, to generate the fingerprint in the form used by AWS to show fingerprints for uploaded public keys (SSH2 MD5), like:

7a:58:3a:a3:df:ba:a3:09:be:b5:b4:0b:f5:5b:09:a0

They can be generated by extracting the public part from the private key and hashing it using:

openssl pkey -in id_rsa -pubout -outform DER | openssl md5 -c

Keys generated on AWS

If the key fingerprint shown on the AWS console is longer then it was a private key generated on AWS, like:

ea:47:42:52:2c:25:43:76:65:f4:67:76:b9:70:b4:64:12:00:e4:5a

In this case you need to use the following command, also shown by Daniel on the AWS forums, to generate a sha1 hash based on the private key:

openssl pkcs8 -in aws_private.pem -nocrypt -topk8 -outform DER | openssl sha1 -c

on the downloaded AWS-generated private key/certificate file. It'll work on keys you converted to OpenSSH format too.

References

See:

  • 4
    Sad the missing clarity from AWS about it, they are opening a potential security breach making it harder to verify keys – Jaime Hablutzel Oct 18 '14 at 4:55
  • Great answer! On the initial ssh command, with more recent versions you need a -E option to specify md5 format: ssh-keygen -E md5 -l -f id_rsa. – RichVel Apr 7 '17 at 5:50

If you only have public keys, you can generate the AWS fingerprint as follows:

ssh-keygen -e -f id_rsa.pub -m pkcs8 | openssl pkey -pubin -outform der | openssl md5 -c

There's a resource on AWS docs http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#verify-key-pair-fingerprints

If you created your key pair using AWS, you can use the OpenSSL tools to generate a fingerprint from the private key file:

Copy

$ openssl pkcs8 -in path_to_private_key -inform PEM -outform DER -topk8 -nocrypt | openssl sha1 -c

If you created your key pair using a third-party tool and uploaded the public key to AWS, you can use the OpenSSL tools to generate a fingerprint from the private key file on your local machine:

Copy

$ openssl rsa -in path_to_private_key -pubout -outform DER | openssl md5 -c

The output should match the fingerprint that's displayed in the console.

For those of us using Python

from Crypto.PublicKey import RSA
import hashlib
import base64

#Load your key from disk, or a string, or generate.
my_key = RSA.importKey(open(my_rsa_private_key, 'r').read())

# Normal md5 fingerprint
fp_plain = hashlib.md5(base64.b64decode(my_key.exportKey('OpenSSH').strip().split()[1].encode('ascii'))).hexdigest()
print ':'.join(a+b for a,b in zip(fp_plain[::2], fp_plain[1::2]))

#AWS' EC2 fingerprint
public_only_key = RSA.importKey(my_key.exportKey('OpenSSH'))
fp_plain = hashlib.md5(public_only_key.exportKey('DER')).hexdigest()
print ':'.join(a+b for a,b in zip(fp_plain[::2], fp_plain[1::2]))
  • Unfortunately this failed for me on macOS 10.11 using latest Homebrew Python 2.7.13, with this error: ValueError: PEM encryption format not supported. – RichVel Apr 7 '17 at 5:45
  • @RichVel, I cannot reproduce the error. I just tested is on macOS 10.12 using homebrew python 2.7.13 in a virtualenv, and it worked just fine. If I had to guess, maybe some of the C requirements for pycrypto were not met for you. Maybe this might help? – Andy Apr 11 '17 at 21:14

This is what I use:

openssl rsa -RSAPublicKey_in -in <(ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PEM) -inform PEM -outform DER 2>/dev/null | openssl md5 -c | awk '{print $2}'

This generates the fingerprint from the public key, similar to some of the above.

#!/bin/bash
key_file=$1
if [[ -n $key_pub_file ]]; then
    ssh-keygen -e -f $key_pub_file -m pkcs8 | openssl pkey -pubin -outform der | openssl md5 -c
else
    echo "pass the pub file as argument"
fi

Here is a script that I use, add the script path to env. Thanks to J.Doe for the answer

Just in case this could be useful: https://ssh-vault.com/post/fingerprint/

for example:

$ ssh-vault -u bob -f

Will print the fingerprint for user bob matching the format AWS is using.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.