I'd like to convert an existing public key (generated using ssh-keygen) from PEM-format to DER-format

I tried:

openssl rsa -in ~/.ssh/id_rsa.pub -inform PEM -pubin -outform DER -out ~/.ssh/id_rsa.pub.der

Unfortunately this gives the following error:

unable to load Public Key
139946985690784:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: PUBLIC KEY

The file ~/.ssh/id_rsa.pub contains a public key; cat ~/.ssh/id_rsa.pub gives:

ssh-rsa ...... user@machine

What am I doing wrong?


OpenSSH public key format is different from PEM format. You have to run ssh-keygen to convert it.

ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PEM >pubkey.pem

Then convert it to DER format using openssl rsa.

openssl rsa -RSAPublicKey_in -in pubkey.pem -inform PEM -outform DER -out ~/.ssh/id_rsa.pub.der -RSAPublicKey_out

Note that you also have to specify -RSAPublicKey_in (not -pubin) and -RSAPublicKey_out to keep it to be RSA Public Key (PKCS#1).

  • Doesn't work in MacOS: unknown option -RSAPublicKey_in – nakajuice Mar 8 '18 at 11:44
  • Works on MacOS 10.14.6 with openssl 2.6.5 – Leo Sep 11 '19 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.