10

I will preface this that I am extremely inexperienced with certs/keys and I am using a Mac.

My problem is with RSA and OPENSSH certs/keys. I currently have a valid RSA cert/key, but I need to convert them to OpenSSH. From my understanding, I want to do the opposite of this thread: Openssh Private Key to RSA Private Key

I have a file that starts with:

-----BEGIN RSA PRIVATE KEY-----

But I need to convert it to this:

-----BEGIN OPENSSH PRIVATE KEY-----

I have tried ssh-keygen -p -N "" -m pem -f /path/to/key and ssh-keygen -f /path/to/key -m pem but it does not output with the OPENSSH header I expected.

  1. Is this possible?
  2. If it is possible, what can I use to perform this conversion and what would a potential command be?
  3. Do I need to do anything to convert the cert if I converted the key?
  4. If I do need to convert the cert, what is the command for that?
  5. If there is any further explanation on what converting from RSA to OPENSSH is, I would really appreciate it.
Impurity
  • 1,037
  • 2
  • 16
  • 31
  • Per documentation at https://man7.org/linux/man-pages/man1/ssh-keygen.1.html `Setting a format of “PEM” when generating or updating a supported private key type will cause the key to be stored in the legacy PEM private key format` – Jing He Sep 20 '21 at 15:31

1 Answers1

23

As long as you are using -m PEM in your command, the result won't be an OPENSSH format.

This will convert an RSA/PEM private key into an OPENSSH one:

ssh-keygen -p -N "" -f /path/to/key

You can then extract its public key and confirm it is identical to the one you have before:

ssh-keygen -y -f /path/to/key
vcsjones
  • 138,677
  • 31
  • 291
  • 286
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • 1
    I think there is some version dependence here. I had to add the ``-o`` argument to get ssh-keygen to output OpenSSH format. This seems to be dependant on versions OpenSSH 6.5 and greater. – hydrian Sep 20 '21 at 16:54
  • @hydrian True. I am not familiar with 6.x version, and work most often with 7.8 and more: https://stackoverflow.com/a/53645530/6309 – VonC Sep 20 '21 at 17:01