When i try to convert SSH2 RSA format based private key to .pem format, using openssl i am getting the below error.

[jbadmin@xxxxxxx .ssh2]$ openssl req -x509 -key /home/jbadmin/.ssh2/id_rsa_2048_a -nodes -days 365 -newkey rsa:2048 -out id_rsa_2048_a.pem
unable to load Private Key
139994671441736:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY

My Private Key:

[jbadmin@xxxxxx.ssh2]$ cat id_rsa_2048_a
Subject: jbadmin
Comment: "2048-bit rsa, jbadmin@x01bicallapp1a, Tue Dec 29 2015 11:38:\

Please suggest me if there is any other way of doing it using openssl or ssh-keygen-g3

EDIT1: Tried below option, still same issue

[jbadmin@x01bicallapp1a .ssh2]$ openssl rsa -outform PEM -in /home/jbadmin/.ssh2/id_rsa_2048_a -out /home/jbadmin/.ssh2/id_rsa_2048_a.pem
unable to load Private Key
140493432293192:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY
  • PEM is an encoding format for keys - both DSA and RSA can use it. Also openssl req is for creating a Certificate Signing Request (CSR). You want something more like: openssl rsa --outform PEM --in /home/jbadmin/.ssh2/id_rsa_2048_a -out /home/jbadmin/.ssh2/id_rsa_2048_a.pem
    – darklion
    Jan 4, 2016 at 9:57
  • It seems that neither openssl or ssh-keygen can convert the private key (the latter can convert the public). A quick read of unix.stackexchange.com/questions/84060/… suggests that it might be possible using puttygen. Jan 4, 2016 at 15:24
  • @garethTheRed, Thanks for providing a useful link, unfortunately puttygen and ssh-keygen options are not available on our server. finally i managed to do it using ssh-keygen-g3.
    – Uppicharla
    Jan 5, 2016 at 3:21
  • That's excellent news. Answering your own question is encouraged on this site, so you should edit your post to remove your solution and add it as an answer instead. You never know, you may gain some points for it :-) Jan 5, 2016 at 7:24

2 Answers 2


ssh-keygen -p can convert between SSH2 and PEM formats:

 -m key_format
         Specify a key format for key generation, the -i (import),
         -e (export) conversion options, and the -p change
         passphrase operation.  The latter may be used to convert
         between OpenSSH private key and PEM private key formats.
         The supported key formats are: “RFC4716” (RFC 4716/SSH2
         public or private key), “PKCS8” (PKCS8 public or private
         key) or “PEM” (PEM public key).  By default OpenSSH will
         write newly-generated private keys in its own format, but
         when converting public keys for export the default format
         is “RFC4716”.  Setting a format of “PEM” when generating or
         updating a supported private key type will cause the key to
         be stored in the legacy PEM private key format.

From SSH2 to PEM:

ssh-keygen -p -f id_rsa -m PEM

From PEM to SSH2:

ssh-keygen -p -f id_rsa -m SSH2

Warning: The specified file gets overwritten and updated in-place!

Note: While ssh-keygen-g3 is linked to a commercial product, ssh-keygen is the more common, open-source counterpart. You can get it for free on your system, and it is available for Linux, Windows, FreeBSD and PASE among others. If you prefer, you can perform the conversion on a system that has it: SSH2/PEM keys are just plain text files after all, just be careful not to leave them around.


Solution: I used the below command to get it worked

$ ssh-keygen-g3 --key-format openssh2  --import-private-key /home/jbadmin/.ssh2/id_rsa_2048_a /home/jbadmin/.ssh2/id_rsa_2048_a_openssh.pem
Imported private key in /home/jbadmin/.ssh2/id_rsa_2048_a to /home/jbadmin/.ssh2/id_rsa_2048_a_openssh.pem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.