I have a pair of keys generated using: ssh-keygen -t rsa -b 4096 -f ~/.ssh/keys/my_key -C "blah@gmail.com". This yielded 2 files my_key and my_key.pub.

Now I need to convert that pair to a .pem key that is filezilla compatible (to connect over sftp).

I already tried something like ssh-keygen -f my_key -m 'PEM' -e > my_key.pem but filezilla kept complaining It doesn't contain a private key.

I am running Ubuntu 22.04 x64.

Please advise.

1 Answer 1


(For OpenSSH 7.8 up, which includes your 8.9) from man ssh-keygen or on the web

This option will read a private or public OpenSSH key file and print to stdout a public key in one of the formats specified by the -m option. ...

Note the words 'public key'. To authenticate yourself, which is what you want FileZilla to do, you need the private key not (just) the public key.

-m key_format
Specify a key format for key generation, the -i (import), -e (export) conversion options, and the -p change passphrase operation. The latter may be used to convert between OpenSSH private key and PEM private key formats. ...

As it says, use ssh-keygen -p -f .../my_key -m pem to 'change' the password -- it needn't really change, you can enter the new password the same as the old one, but regardless ssh-keygen re-writes the private key file in the desired format. (Since this overwrites the previous file, if you want to also keep the OpenSSH-new-format version, make a backup before doing this operation, or do it on a copy.)

For completeness, if you have (or get) (new enough) Putty, its utility puttygen can convert OpenSSH-new-format to either OpenSSL-PEM or Putty-PPK formats, both of which FileZilla can read.

  • Thank you. I have tried many variations of this command in vain. Now it works. Finally, I wonder if there's a way to generate it to a new file rather than overriding the old one to avoid doing it by mistake...
    – Enissay
    Jul 14 at 11:14
  • Enissay: you can generate a key in 'old'=OpenSSL format with e.g. ssh-keygen -t rsa -b 4096 -m pem [-f filename] [-C comment]. But that wasn't in your Q. Jul 15 at 7:12
  • That would be a different key... I was just hoping for safety for a way to avoid crushing my key by mistake... I kept a note and hope for the best xD
    – Enissay
    Jul 17 at 23:43
  • Sorry: I missed new file; in cryptospeak 'generate' always means a new key. No, -p always rewrites the same (preexisting) file, so as I said make a backup or copy first if you want. Jul 18 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.