I'm trying to create a private key and having an issue.

When I use ssh-keygen -t rsa -b 4096 -C "your_email@example.com", I get a private key in the following format.


And this is not being accepted for an application that I'm trying to use.

I'm expecting a key in the following RSA format.

Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,25737CC2C70BFABADB1B4598BD8AB9E9


How do I create the correct format? This is weird because every other mac I have creates the correct format, except the one I'm having problem with.

I'm on a fresh installed Mac OS Mojave

  • and the other Macs are not on Mojave? I am on Mojave too and get the "new" openssh key format. So I assume other Macs are on lower versions. Check the OpenSSL version used. – Zina Nov 14 '18 at 0:21
  • @Zina other Macs are also on Mojave and have the same OpenSSL version. – Moon Nov 14 '18 at 1:44
  • RSA should be the default type. What if you omit the -t rsa option altogether? – guzzijason Nov 14 '18 at 1:45
  • @guzzijason it's the same. That's what's driving me crazy. Even if I omit the -t rsa on my mac (working one), it generates RSA correctly. – Moon Nov 14 '18 at 1:46
  • I've had the same problem. As workaround I've used older version of openssh to generate key. You can test if your generated key is correct with openssl rsa -text -in key_file -passin 'pass:passphrase'. Version 7.4p1-16 works. – atype Nov 14 '18 at 7:15

I faced the same problem recently (after upgrade to mojave 10.14.1), here are 2 possible solutions for this issue.

  • Downgrade your ssh-keygen binary (you can easily get old version from any linux/docker image)


  • Add option -m PEM into your ssh-keygen command. For example, you can run ssh-keygen -m PEM -t rsa -b 4096 -C "your_email@example.com" to force ssh-keygen to export as PEM format.

It seems like in the current ssh-keygen version in mojave, the default export format is RFC4716 as mentioned here

  • 1
    The default export publickey format is indeed rfc4716, but the format in the Q is an internal privatekey format and is OpenSSH's 'new' format, which didn't exist in 1999(!), and is no longer in described in current; try 6.0 to 6.3. – dave_thompson_085 Nov 28 '18 at 9:25
  • 3
    I'm not able to edit the answer but please be clear that 1. and 2. are independent solutions, not sequential steps. You do NOT need to downgrade for a one-off key generation. Just add the -m PEM – sdoxsee Jan 23 '19 at 15:55

New keys with OpenSSH private key format can be converted using ssh-keygen utility to the old PEM format.

ssh-keygen -p -m PEM -f ~/.ssh/id_rsa

There is no need to downgrade to older OpenSSH just to achieve this result.

  • Yes. Like I already mentioned in the comments on the accepted answer. serverfault.com/questions/939909/… – sdoxsee Jan 25 '19 at 15:01
  • 9
    What's not clear in the accepted answer is that you don't need to create a new key pair. You can take your existing key and convert them with that command. It overwrites the file, so I think it's a good idea to make a backup before, just in case. – martintama Feb 22 '19 at 11:15
  • Thanks for adding instructions on how to convert an existing private key to RSA format. Just saved my bacon! – Craig Blaszczyk Aug 7 '19 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.