I created a key pair using ssh-keygen and get the two clasic id_rsa and id_rsa.pub.

I imported the public key into my AWS EC2 account.

Now I created a windows instance and to decrypt that instance password, AWS console is asking me for a .pem file. How I can get that .pem file from my two id_rsa and id_rsa.pub files?

  • 2
    The private key is already in PEM format and can be used as-is. – Michael Hampton Jul 16 '15 at 18:59
  • @MichaelHampton, this will depend on the version of ssh-keygen and the command used to generate the key pair. Some versions use RFC4716 by default, instead of PEM. – austinian Jul 16 '15 at 20:16

According to this, this command can be used:

ssh-keygen -f id_rsa -e -m pem

This will convert your public key to an OpenSSL compatible format. Your private key is already in PEM format and can be used as is (as Michael Hampton stated).

Double check if AWS isn't asking for a (X.509) certificate in PEM format, which would be a different thing than your SSH keys.

  • But they don't need the public key do they? They need the private key for decrypting their password from the AWS Console – Michael Bailey Jul 16 '15 at 18:40
  • I have no idea what OP needs this for. – fuero Jul 16 '15 at 18:41
  • Not sure how familiarized you are with AWS, but when you spin up a windows instance (basically server) AWS keeps the password from you until you give them your private key. Then they give you the server password. That way Windows and Linux servers on AWS both depend on private keys. – Michael Bailey Jul 16 '15 at 18:43
  • 1
    This doesn't work on OS X (ssh -v ==> OpenSSH_6.2p2) – chrish Mar 3 '16 at 20:50
  • 3
    contrary to the documentation, it will output PUBLIC key in PEM format, not the private one. currently ssh-keygen does not support converting private keys. – morgwai Aug 10 '18 at 8:44

Using ssh-keygen to export the key in the .pem format worked for me.

ssh-keygen -f id_rsa.pub -m 'PEM' -e > id_rsa.pem

Then simply copy the .pem key as necessary.

For reference:

  • the -f id_rsa.pub portion indicates the input file to read from
  • -m 'PEM indicates a PEM filetype
  • the -e option indicates that the output will be exported

id_rsa is the file that you have to use to decrypt the Windows EC2 instance password, but just make sure that the file you copy paste is not phrase protected.

I solved the problem getting a temporarily unprotected the id_rsa file with something like:

$ openssl rsa -in ~/.ssh/id_rsa -out tmp_file.pem

When you launch an EC2 instance, you assign to it a key pair (or none). It cannot be changed afterwards.

Only using that .pem file from that key pair will you be able to decrypt the Windows password.

The .pem file would have been downloaded when the key pair was created. You cannot get it again. If you have lost it, you're out of luck.

You cannot use a .pem file that you generated yourself unless you imported that key into AWS before the instance was launched and assigned it to the instance.

Simply put, if you don't have the original .pem file, you cannot get the password.

Edit: after re-reading the question, I realize the OP had imported his key into AWS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.