I'm trying to create a private key and having an issue.

When I use ssh-keygen -t rsa -b 4096 -C "your_email@example.com", I get a private key in the following format.


And this is not being accepted for an application that I'm trying to use.

I'm expecting a key in the following RSA format.

Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,25737CC2C70BFABADB1B4598BD8AB9E9


How do I create the correct format? This is weird because every other mac I have creates the correct format, except the one I'm having problem with.

I'm on a fresh installed Mac OS Mojave

  • and the other Macs are not on Mojave? I am on Mojave too and get the "new" openssh key format. So I assume other Macs are on lower versions. Check the OpenSSL version used.
    – Zina
    Nov 14, 2018 at 0:21
  • @Zina other Macs are also on Mojave and have the same OpenSSL version.
    – Moon
    Nov 14, 2018 at 1:44
  • RSA should be the default type. What if you omit the -t rsa option altogether?
    – guzzijason
    Nov 14, 2018 at 1:45
  • @guzzijason it's the same. That's what's driving me crazy. Even if I omit the -t rsa on my mac (working one), it generates RSA correctly.
    – Moon
    Nov 14, 2018 at 1:46
  • I've had the same problem. As workaround I've used older version of openssh to generate key. You can test if your generated key is correct with openssl rsa -text -in key_file -passin 'pass:passphrase'. Version 7.4p1-16 works.
    – atype
    Nov 14, 2018 at 7:15

3 Answers 3


I faced the same problem recently (after upgrade to mojave 10.14.1), here are 2 possible solutions for this issue.

  • Downgrade your ssh-keygen binary (you can easily get old version from any linux/docker image)


  • Add option -m PEM into your ssh-keygen command. For example, you can run ssh-keygen -m PEM -t rsa -b 4096 -C "your_email@example.com" to force ssh-keygen to export as PEM format.

It seems like in the current ssh-keygen version in mojave, the default export format is RFC4716 as mentioned here

  • 2
    The default export publickey format is indeed rfc4716, but the format in the Q is an internal privatekey format and is OpenSSH's 'new' format, which didn't exist in 1999(!), and is no longer in described in current; try 6.0 to 6.3. Nov 28, 2018 at 9:25
  • 4
    I'm not able to edit the answer but please be clear that 1. and 2. are independent solutions, not sequential steps. You do NOT need to downgrade for a one-off key generation. Just add the -m PEM
    – sdoxsee
    Jan 23, 2019 at 15:55
  • 2
    Adding -m PEM fixed a very frustrating issue I was having with JWT signing. Thank you!! Dec 31, 2020 at 16:48

New keys with OpenSSH private key format can be converted using ssh-keygen utility to the old PEM format.

ssh-keygen -p -m PEM -f ~/.ssh/id_rsa

There is no need to downgrade to older OpenSSH just to achieve this result.

  • Yes. Like I already mentioned in the comments on the accepted answer. serverfault.com/questions/939909/…
    – sdoxsee
    Jan 25, 2019 at 15:01
  • 22
    What's not clear in the accepted answer is that you don't need to create a new key pair. You can take your existing key and convert them with that command. It overwrites the file, so I think it's a good idea to make a backup before, just in case.
    – martintama
    Feb 22, 2019 at 11:15
  • 2
    Thanks for adding instructions on how to convert an existing private key to RSA format. Just saved my bacon! Aug 7, 2019 at 9:50
  • 1
    it does not change the content to me,
    – Whimusical
    May 12, 2020 at 17:09

Some elaboration on the above answers to provide a clear path for both the public and private key.

You can directly export (-e) your ssh keys to a pem format:

For your public key:

cd ~/.ssh
ssh-keygen -e -m PEM -f id_rsa > id_rsa.pub.pem

For your private key:

Things are a little tricker as ssh-keygen only allows the private key file to be change 'in-situ'. (i.e. it replaces your key file with the new file).

So you can keep your old file:

Given we are just exporting the file the <new pass phrase> can be identical to your <old pass phrase> (unless you want to change the pass phrase at the same time).

cd ~/.ssh
cp id_rsa id_rsa.bak
ssh-keygen -p -P "<old pass phrase>" -N "<new pass phrase>" -m PEM -f id_rsa 
cp id_rsa id_rsa.priv.pem
cp id_rsa.bak id_rsa

NOTE: it is a bad idea to pass your pass phrase as an argument to a cli app.

The secure method is:

cd ~/.ssh
cp id_rsa id_rsa.bak
ssh-keygen -p  -m PEM -f id_rsa 
cp id_rsa id_rsa.priv.pem
cp id_rsa.bak id_rsa

With this method you will be prompted for your old and new pass phrase.

Note: after converting your private key file to a .pem the file is now in clear text, this is bad.

  • 1
    Note that the -e option now requires -f in front of the input filename: ssh-keygen -e -m PEM -f id_rsa > id_rsa.pub.pem Nov 4, 2021 at 0:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.