125

I'm trying to create a private key and having an issue.

When I use ssh-keygen -t rsa -b 4096 -C "your_email@example.com", I get a private key in the following format.

-----BEGIN OPENSSH PRIVATE KEY-----
uTo43HGophPo5awKC8hoOz4KseENpgHDLxe5UX+amx8YrWvZCvsYRh4/wnwxijYx
...
-----END OPENSSH PRIVATE KEY-----

And this is not being accepted for an application that I'm trying to use.

I'm expecting a key in the following RSA format.

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,25737CC2C70BFABADB1B4598BD8AB9E9

uTo43HGophPo5awKC8hoOz4KseENpgHDLxe5UX+amx8YrWvZCvsYRh4/wnwxijYx
...
-----END RSA PRIVATE KEY-----

How do I create the correct format? This is weird because every other mac I have creates the correct format, except the one I'm having problem with.

I'm on a fresh installed Mac OS Mojave

6
  • and the other Macs are not on Mojave? I am on Mojave too and get the "new" openssh key format. So I assume other Macs are on lower versions. Check the OpenSSL version used. – Zina Nov 14 '18 at 0:21
  • @Zina other Macs are also on Mojave and have the same OpenSSL version. – Moon Nov 14 '18 at 1:44
  • RSA should be the default type. What if you omit the -t rsa option altogether? – guzzijason Nov 14 '18 at 1:45
  • @guzzijason it's the same. That's what's driving me crazy. Even if I omit the -t rsa on my mac (working one), it generates RSA correctly. – Moon Nov 14 '18 at 1:46
  • I've had the same problem. As workaround I've used older version of openssh to generate key. You can test if your generated key is correct with openssl rsa -text -in key_file -passin 'pass:passphrase'. Version 7.4p1-16 works. – atype Nov 14 '18 at 7:15
125

I faced the same problem recently (after upgrade to mojave 10.14.1), here are 2 possible solutions for this issue.

  • Downgrade your ssh-keygen binary (you can easily get old version from any linux/docker image)

OR

  • Add option -m PEM into your ssh-keygen command. For example, you can run ssh-keygen -m PEM -t rsa -b 4096 -C "your_email@example.com" to force ssh-keygen to export as PEM format.

It seems like in the current ssh-keygen version in mojave, the default export format is RFC4716 as mentioned here

3
  • 1
    The default export publickey format is indeed rfc4716, but the format in the Q is an internal privatekey format and is OpenSSH's 'new' format, which didn't exist in 1999(!), and is no longer in described in current; try 6.0 to 6.3. – dave_thompson_085 Nov 28 '18 at 9:25
  • 3
    I'm not able to edit the answer but please be clear that 1. and 2. are independent solutions, not sequential steps. You do NOT need to downgrade for a one-off key generation. Just add the -m PEM – sdoxsee Jan 23 '19 at 15:55
  • 1
    Adding -m PEM fixed a very frustrating issue I was having with JWT signing. Thank you!! – Keshav Saharia Dec 31 '20 at 16:48
107

New keys with OpenSSH private key format can be converted using ssh-keygen utility to the old PEM format.

ssh-keygen -p -m PEM -f ~/.ssh/id_rsa

There is no need to downgrade to older OpenSSH just to achieve this result.

4
  • Yes. Like I already mentioned in the comments on the accepted answer. serverfault.com/questions/939909/… – sdoxsee Jan 25 '19 at 15:01
  • 18
    What's not clear in the accepted answer is that you don't need to create a new key pair. You can take your existing key and convert them with that command. It overwrites the file, so I think it's a good idea to make a backup before, just in case. – martintama Feb 22 '19 at 11:15
  • 1
    Thanks for adding instructions on how to convert an existing private key to RSA format. Just saved my bacon! – Craig Blaszczyk Aug 7 '19 at 9:50
  • 1
    it does not change the content to me, – Whimusical May 12 '20 at 17:09
1

Some elaboration on the above answers to provide a clear path for both the public and private key.

You can directly export (-e) your ssh keys to a pem format:

For your public key:

cd ~/.ssh
ssh-keygen -e -m PEM id_rsa > id_rsa.pub.pem

For your private key:

Things are a little tricker as ssh-keygen only allows the private key file to be change 'in-situ'. (i.e. it replaces your key file with the new file).

So you can keep your old file:

Given we are just exporting the file the <new pass phrase> can be identical to your <old pass phrase> (unless you want to change the pass phrase at the same time).

cd ~/.ssh
cp id_rsa id_rsa.bak
ssh-keygen -p -P "<old pass phrase>" -N "<new pass phrase>" -m PEM -f id_rsa 
cp id_rsa id_rsa.priv.pem
cp id_rsa.bak id_rsa

NOTE: it is a bad idea to pass your pass phrase on the cli.

The secure method is:

cd ~/.ssh
cp id_rsa id_rsa.bak
ssh-keygen -p  -m PEM -f id_rsa 
cp id_rsa id_rsa.priv.pem
cp id_rsa.bak id_rsa

With this method you will be prompted for your old and new pass phrase.

Note: after converting your private key file to a .pem the file is now in clear text, this is bad.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.