I'd like to convert an existing public key (generated using ssh-keygen) from PEM-format to DER-format

I tried:

openssl rsa -in ~/.ssh/id_rsa.pub -inform PEM -pubin -outform DER -out ~/.ssh/id_rsa.pub.der

Unfortunately this gives the following error:

unable to load Public Key
139946985690784:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: PUBLIC KEY

The file ~/.ssh/id_rsa.pub contains a public key; cat ~/.ssh/id_rsa.pub gives:

ssh-rsa ...... user@machine

What am I doing wrong?

1 Answer 1


OpenSSH public key format is different from PEM format. You have to run ssh-keygen to convert it.

ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PEM >pubkey.pem

Then convert it to DER format using openssl rsa.

openssl rsa -RSAPublicKey_in -in pubkey.pem -inform PEM -outform DER -out ~/.ssh/id_rsa.pub.der -RSAPublicKey_out

Note that you also have to specify -RSAPublicKey_in (not -pubin) and -RSAPublicKey_out to keep it to be RSA Public Key (PKCS#1).

  • Doesn't work in MacOS: unknown option -RSAPublicKey_in
    – nakajuice
    Mar 8, 2018 at 11:44
  • Works on MacOS 10.14.6 with openssl 2.6.5
    – Leo
    Sep 11, 2019 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .