137

I'm trying to create a private key and having an issue.

When I use ssh-keygen -t rsa -b 4096 -C "your_email@example.com", I get a private key in the following format.

-----BEGIN OPENSSH PRIVATE KEY-----
uTo43HGophPo5awKC8hoOz4KseENpgHDLxe5UX+amx8YrWvZCvsYRh4/wnwxijYx
...
-----END OPENSSH PRIVATE KEY-----

And this is not being accepted for an application that I'm trying to use.

I'm expecting a key in the following RSA format.

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,25737CC2C70BFABADB1B4598BD8AB9E9

uTo43HGophPo5awKC8hoOz4KseENpgHDLxe5UX+amx8YrWvZCvsYRh4/wnwxijYx
...
-----END RSA PRIVATE KEY-----

How do I create the correct format? This is weird because every other mac I have creates the correct format, except the one I'm having problem with.

I'm on a fresh installed Mac OS Mojave

Bruce Becker
  • 277
  • 1
  • 4
  • 18
Moon
  • 2,033
  • 4
  • 24
  • 23
  • and the other Macs are not on Mojave? I am on Mojave too and get the "new" openssh key format. So I assume other Macs are on lower versions. Check the OpenSSL version used. – Zina Nov 14 '18 at 00:21
  • @Zina other Macs are also on Mojave and have the same OpenSSL version. – Moon Nov 14 '18 at 01:44
  • RSA should be the default type. What if you omit the `-t rsa` option altogether? – guzzijason Nov 14 '18 at 01:45
  • @guzzijason it's the same. That's what's driving me crazy. Even if I omit the -t rsa on my mac (working one), it generates RSA correctly. – Moon Nov 14 '18 at 01:46
  • I've had the same problem. As workaround I've used older version of openssh to generate key. You can test if your generated key is correct with openssl rsa -text -in key_file -passin 'pass:passphrase'. Version 7.4p1-16 works. – atype Nov 14 '18 at 07:15
  • This is a change in OpenSSH 7.8; crossdupe https://stackoverflow.com/questions/52547954/ssh-keygen-ignoring-t-parameter/ (my answer) – dave_thompson_085 Nov 28 '18 at 09:15

3 Answers3

139

I faced the same problem recently (after upgrade to mojave 10.14.1), here are 2 possible solutions for this issue.

  • Downgrade your ssh-keygen binary (you can easily get old version from any linux/docker image)

OR

  • Add option -m PEM into your ssh-keygen command. For example, you can run ssh-keygen -m PEM -t rsa -b 4096 -C "your_email@example.com" to force ssh-keygen to export as PEM format.

It seems like in the current ssh-keygen version in mojave, the default export format is RFC4716 as mentioned here

Mark Ribau
  • 168
  • 1
  • 5
sayboras
  • 1,514
  • 1
  • 6
  • 5
  • 2
    The default _export publickey_ format is indeed rfc4716, but the format in the Q is an internal privatekey format and is OpenSSH's 'new' format, which didn't exist in 1999(!), and is no longer in described in current; try 6.0 to 6.3. – dave_thompson_085 Nov 28 '18 at 09:25
  • 4
    I'm not able to edit the answer but please be clear that 1. and 2. are independent solutions, not sequential steps. You do NOT need to downgrade for a one-off key generation. Just add the ```-m PEM``` – sdoxsee Jan 23 '19 at 15:55
  • 2
    Adding -m PEM fixed a very frustrating issue I was having with JWT signing. Thank you!! – Keshav Saharia Dec 31 '20 at 16:48
123

New keys with OpenSSH private key format can be converted using ssh-keygen utility to the old PEM format.

ssh-keygen -p -m PEM -f ~/.ssh/id_rsa

There is no need to downgrade to older OpenSSH just to achieve this result.

mydeardiary
  • 1,331
  • 1
  • 5
  • 2
  • Yes. Like I already mentioned in the comments on the accepted answer. https://serverfault.com/questions/939909/ssh-keygen-does-not-create-rsa-private-key#comment1235407_941893 – sdoxsee Jan 25 '19 at 15:01
  • 22
    What's not clear in the accepted answer is that you don't need to create a new key pair. You can take your existing key and convert them with that command. It overwrites the file, so I think it's a good idea to make a backup before, just in case. – martintama Feb 22 '19 at 11:15
  • 2
    Thanks for adding instructions on how to convert an existing private key to RSA format. Just saved my bacon! – Craig Blaszczyk Aug 07 '19 at 09:50
  • 1
    it does not change the content to me, – Whimusical May 12 '20 at 17:09
5

Some elaboration on the above answers to provide a clear path for both the public and private key.

You can directly export (-e) your ssh keys to a pem format:

For your public key:

cd ~/.ssh
ssh-keygen -e -m PEM -f id_rsa > id_rsa.pub.pem

For your private key:

Things are a little tricker as ssh-keygen only allows the private key file to be change 'in-situ'. (i.e. it replaces your key file with the new file).

So you can keep your old file:

Given we are just exporting the file the <new pass phrase> can be identical to your <old pass phrase> (unless you want to change the pass phrase at the same time).

cd ~/.ssh
cp id_rsa id_rsa.bak
ssh-keygen -p -P "<old pass phrase>" -N "<new pass phrase>" -m PEM -f id_rsa 
cp id_rsa id_rsa.priv.pem
cp id_rsa.bak id_rsa

NOTE: it is a bad idea to pass your pass phrase as an argument to a cli app.

The secure method is:

cd ~/.ssh
cp id_rsa id_rsa.bak
ssh-keygen -p  -m PEM -f id_rsa 
cp id_rsa id_rsa.priv.pem
cp id_rsa.bak id_rsa

With this method you will be prompted for your old and new pass phrase.

Note: after converting your private key file to a .pem the file is now in clear text, this is bad.

Brett Sutton
  • 161
  • 1
  • 4
  • 1
    Note that the `-e` option now requires `-f` in front of the input filename: `ssh-keygen -e -m PEM -f id_rsa > id_rsa.pub.pem` – Jason Machacek Nov 04 '21 at 00:42