When I import my OpenSSH public key into AWS EC2's keyring the fingerprint that AWS shows doesn't match what I see from:
ssh-keygen -l -f my_key
It is a different length and has different bytes.
Why? I'm sure I uploaded the correct key.
AWS EC2 shows the SSH2 fingerprint, not the OpenSSH fingerprint everyone expects. It doesn't say this in the UI.
It also shows two completely different kinds of fingerprints depending on whether the key was generated on AWS and downloaded, or whether you uploaded your own public key.
Fingerprints generated with
ssh-keygen -l -f id_rsa
will not match what EC2 shows. You can either use the AWS API tools to generate a fingerprint with the
ec2-fingerprint-key command, or use OpenSSL to do it.
Note that if you originally generated a key on AWS, but then uploaded it again (say, to another region) then you'll get a different fingerprint because it'll take the SSH2 RSA fingerprint, rather than the sha1 it shows for keys you generated on AWS.
In the above,
test-generated was generated using AWS EC2.
test-generated-reuploaded is the public key from the private key AWS generated, extracted with
ssh-keygen -y and uploaded again. The third key,
test-uploaded, is a locally generated key ... but the local
ssh-keygen -l fingerprint is
$ ssh-keygen -l -f theprivatekey 2048 b2:2c:86:d6:1e:58:c0:b0:15:97:ab:9b:93:e7:4e:ea $ openssl pkey -in theprivatekey -pubout -outform DER | openssl md5 -c Enter pass phrase for id_landp: (stdin)= 91:bc:58:1f:ea:5d:51:2d:83:d3:6b:d7:6d:63:06:d2
You can use OpenSSL, as demonstrated by Daniel on the AWS forums, to generate the fingerprint in the form used by AWS to show fingerprints for uploaded public keys (SSH2 MD5), like:
They can be generated by extracting the public part from the private key and hashing it using:
openssl pkey -in id_rsa -pubout -outform DER | openssl md5 -c
If the key fingerprint shown on the AWS console is longer then it was a private key generated on AWS, like:
In this case you need to use the following command, also shown by Daniel on the AWS forums, to generate a sha1 hash based on the private key:
openssl pkcs8 -in aws_private.pem -nocrypt -topk8 -outform DER | openssl sha1 -c
on the downloaded AWS-generated private key/certificate file. It'll work on keys you converted to OpenSSH format too.
There's a resource on AWS docs http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#verify-key-pair-fingerprints
If you created your key pair using AWS, you can use the OpenSSL tools to generate a fingerprint from the private key file:
$ openssl pkcs8 -in path_to_private_key -inform PEM -outform DER -topk8 -nocrypt | openssl sha1 -c
If you created your key pair using a third-party tool and uploaded the public key to AWS, you can use the OpenSSL tools to generate a fingerprint from the private key file on your local machine:
$ openssl rsa -in path_to_private_key -pubout -outform DER | openssl md5 -c
The output should match the fingerprint that's displayed in the console.
For those of us using Python
from Crypto.PublicKey import RSA import hashlib import base64 #Load your key from disk, or a string, or generate. my_key = RSA.importKey(open(my_rsa_private_key, 'r').read()) # Normal md5 fingerprint fp_plain = hashlib.md5(base64.b64decode(my_key.exportKey('OpenSSH').strip().split().encode('ascii'))).hexdigest() print ':'.join(a+b for a,b in zip(fp_plain[::2], fp_plain[1::2])) #AWS' EC2 fingerprint public_only_key = RSA.importKey(my_key.exportKey('OpenSSH')) fp_plain = hashlib.md5(public_only_key.exportKey('DER')).hexdigest() print ':'.join(a+b for a,b in zip(fp_plain[::2], fp_plain[1::2]))
#!/bin/bash key_file=$1 if [[ -n $key_pub_file ]]; then ssh-keygen -e -f $key_pub_file -m pkcs8 | openssl pkey -pubin -outform der | openssl md5 -c else echo "pass the pub file as argument" fi
Here is a script that I use, add the script path to env. Thanks to J.Doe for the answer