4

I generated my public/private key pair using

ssh-keygen -t rsa -b 2048 -v

and then needed a .pem file and followed this https://serverfault.com/questions/706336/how-to-get-a-pem-file-from-ssh-key-pair

ssh-keygen -f id_rsa -e -m pem   
-----BEGIN RSA PUBLIC KEY-----

but then i found this https://gist.github.com/mingfang/4aba327add0807fa5e7f

openssl rsa -in ~/.ssh/id_rsa -outform pem
-----BEGIN RSA PRIVATE KEY-----

why is the output different?

3

That's how they are written; OpenSSH emits the public key material via a PEM_write_RSAPublicKey(stdout, k->rsa) call in the do_convert_to_pem function of ssh-keygen.c, while OpenSSL operates instead on the given private key. With OpenSSH, I'd imagine that the majority of cases would be to convert the public key into a form usable on some foreign server, with the private key remaining private on the client system, so operating on the public key of the keypair makes sense. With OpenSSL, there is no "get a public key into a form suitable for some other SSH server" concern, so that code operates directly on the private key. Different code, different intentions, different results.

|improve this answer|||||
  • uhm, I really don't understand this answer fully, namely it seems to me, that it does not answer the question at all. From what I understand, both transform commands get PRIVATE KEY as a input, and while second command should change this PRIVATE key to pem format, the first command returns PUBLIC key (-e flag). So that's the main difference IIUC. And the second command need to to work at all, as openssl reguses to work with openssh keys, producing: "unable to load Private Key". Nevertheless, these certificates stuff is in immense mess extremely poorly documented(considering it's crypto area) – Martin Mucha Nov 12 '19 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.