Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors.

Obviously I cannot simply use the ASCII string in the ssh-keygen <>.pub key file as it is in SSH file format or I perhaps SubjectPublicKeyInfo structure.

Here's the key gen code: ssh-keygen -t rsa -b 1024 -C "Test Key"

I found a converter in php on the web which will convert the contents of the public key into a base64 PEM ASCII string format. However the function still doesn't like it.

The Openssl documentation states:

  1. “RSA_PUBKEY() function which process a public key using an EVP_PKEY structure”
  2. “RSA_PUBKEY functions also process an RSA public key using an RSA structure”

How do I get my OpenSSH public key into either format that the OpenSSL function will consume it?

share|improve this question
Figured this out: use the openssl tool only as such: – PeteP Dec 16 '11 at 23:17
Create Private key: openssl genrsa -out test.priv.key 2048; Output Public key in same format (PEM?): openssl rsa -in test.priv.key -pubout -out test.pub.key – PeteP Dec 16 '11 at 23:19


So I walked into this thinking "Easy, I got this." Turns out there's a whole lot more to it than even I thought.

So the first issue is that (according to the man pages for OpenSSL (man 3 pem)), OpenSSL is expecting the RSA key to be in PKCS#1 format. Clearly this isn't what ssh-keygen is working with. You have two options (from searching around).

If you have OpenSSH v. 5.6 or later (I did not on my laptop), you can run this:

ssh-keygen -f key.pub -e -m pem

The longer method of doing this is to break apart your SSH key into it's various components (the blog entry I found some of this in accuses OpenSSH of being "proprietary", I prefer to call it "unique") and then use an ASN1 library to swap things around.

Fortunately for you, someone wrote the code to do this:


share|improve this answer
The ssh-keygen method seems to work on Linux but not Mac OS X. – lid Mar 16 '14 at 18:32
Lid, see the note in the answer about SSH version. OS X doesn't ship a recent version of OpenSSH. Run the command ssh -V. – Brian Redbeard Jun 5 '14 at 15:53
Doesn't work in OpenSSH_6.2p2. Does work in OpenSSH_6.6p1. – Old Pro Sep 23 '14 at 22:30
-m doesn't work for me ... what is the work around? – pstanton Jun 14 at 5:49

Similar to Amal Chaudhuri's method below, this is what worked for me. I needed to create a pem file from the ssh public key I'd generated for my SFTP client (Cyberduck).

openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem
share|improve this answer
this doesn't actually seem to work. – outside2344 Oct 17 '14 at 21:51
id_rsa is not a public key. Wrong answer. – ahmet alp balkan Apr 7 '15 at 21:34
This ONLY works for private RSA key NOT the public key OP was asking. So wrong answer. – Devy Jun 11 '15 at 20:02

Another way to do this from another site. Posting this in case you need another method. Works very well. http://www.chatur.com.np/2011/01/convert-openssh-rsa-key-to-pem-format.html

openssl dsa -in ~/.ssh/id_dsa -outform pem > id_dsa.pem
share|improve this answer
That method doesn't seem to actually work. – Sean Apr 5 '13 at 18:41
id_rsa is not a public key. Wrong answer. – ahmet alp balkan Apr 7 '15 at 21:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.