Is there a way to convert existing pair of OpenSSH keys to the SSH2 (ssh.com format) pair of keys?

UPD: since there are some answers about ssh-keygen suddenly appeared, I'll explain where I came from (also it will be a nice answer on "what have you tried?").

$> diff --report-identical-files <(ssh-keygen -e -f ~/.ssh/id_dsa) <(ssh-keygen -e -f ~/.ssh/id_dsa.pub)
Files /tmp/zshAGGWAK and /tmp/zshPZiIr6 are identical

In other words, ssh-keygen returns same keys for private and public input keys (hashes of original files are obviously different, I've checked them twice to ensure that they are valid private and public keys). It seems to be that ssh-keygen generates only public key for private or public input key.

I'm doing it wrong or it is a normal behavior?

2 Answers 2


This tutorial titled: SSH: Convert OpenSSH to SSH2 and vise versa appears to offer what you're looking for.

Convert OpenSSH key to SSH2 key

Run the OpenSSH version of ssh-keygen on your OpenSSH public key to convert it into the format needed by SSH2 on the remote machine. This must be done on the system running OpenSSH.

$ ssh-keygen -e -f ~/.ssh/id_dsa.pub > ~/.ssh/id_dsa_ssh2.pub

Convert SSH2 key to OpenSSH key

Run the OpenSSH version of ssh-keygen on your ssh2 public key to convert it into the format needed by OpenSSH. This needs to be done on the system running OpenSSH.

$ ssh-keygen -i -f ~/.ssh/id_dsa_1024_a.pub > ~/.ssh/id_dsa_1024_a_openssh.pub

The tutorial goes on to show how to both generate the various types of keys and how to export them to other formats.

Use this for private & public keys?

According to the man page, the answer would be a yes. Looking at the man page for ssh-keygen it states the following for the -e switch:

 -e    This option will read a private or public OpenSSH key file and print
       the key in RFC 4716 SSH Public Key File Format to stdout.  This option
       allows exporting keys for use by several commercial SSH implementations.

But in practice it would appear that ssh-keygen can't convert private keys, only public ones.

For example:

# Make a new RSA key-pair
$ ssh-keygen -t rsa -f newkey

# attempt to extract the private key
$ ssh-keygen -e -f newkey > newkey_e

# attempt to extract the public key
$ ssh-keygen -e -f newkey.pub > newkey.pub_e

# Notice the supposed extracted private key (newkey_e) and the corresponding extracted public key (newkey.pub_e) have identical `md5sum`'s.
$ for i in *;do md5sum $i;done
d1bd1c12c4a2b9fee4b5f8f83150cf1a  newkey
8b67a7be646918afc7a041119e863be5  newkey_e
13947789d5dcc5322768bd8a2d3f562a  newkey.pub
8b67a7be646918afc7a041119e863be5  newkey.pub_e

Looking at the resulting extracted keys confirms this:

$ grep BEGIN newkey_e newkey.pub_e 
newkey_e:---- BEGIN SSH2 PUBLIC KEY ----
newkey.pub_e:---- BEGIN SSH2 PUBLIC KEY ----

Googling a bit I came across this blurb from an article titled: How do you convert OpenSSH Private key files to SSH. The site seemed to be up and down but looking in Google's cache for this page I found the following blurb:

How do you convert OpenSSH Private key files to SSH.com Private key files?

It cannot be done by the ssh-keygen program even though most man pages say it can. They discourage it so that you will use multiple public keys. The only problem is that RCF will not allow you to register more than one public key.

The article goes on to cover a method for converting a openssh private key to a ssh.com private key through the use of PuTTY's puttygen tool. NOTE: puttygen can be run from Windows & Linux.

Open 'puttygen' and generate a 2048 bit rsa public/private key pair. Make sure you add a password after it is generated. Save the public key as "puttystyle.pub" and save the private key as "puttystyle". The putty program and SSH.com programs share a common public-key format but the putty program and OpenSSH have different public-key formats. We will come back to this, later. You should be able to load both puttystyle keys into the putty program. However, the private key formats for putty and SSH.com are not the same and so you will have to create a converted file. Go to the conversions menu and export an SSH.com key. Save it as "sshstyle". Now go back to the conversions menu and export an openssh key. Save it as "openssh". These names are arbitrary and you can choose your own. You will have to change the names for installation on an OpenSSH machine, later. See below.

Given the above I worked out the following using puttygen, using our previously generated private/public openssh key-pair:

# generate ssh.com private key from private openssh key
$ puttygen newkey -O private-sshcom -o newkey.puttygen-sshcom

# generate ssh.com public key from private openssh key
$ puttygen newkey -O public -o newkey.pub_puttygen-sshcom

# generate openssh public key from private openssh key (for confirmation)
$ puttygen newkey -O public-openssh -o newkey.pub_puttygen-openssh

The commenting is different so you can't just compare the resulting files, so if you look at the first few lines of the keys, that's a pretty good indicator that the above commands were successful.

Comparison of public ssh.com keys:

$ tail -n +3 newkey.pub_e | head -1 | cut -c 1-60

$ tail -n +3 newkey.pub_puttygen-sshcom | head -1 | cut -c 1-60

Comparison of public openssh keys:

$ cut -c 1-100 newkey.pub 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFkZdpmbze9c6pT883rE1i64TJd4wbz9x/w6I2DmSZVI9TJa6M9jgGE952QsOY

$ cut -c 1-100 newkey.pub_puttygen-openssh 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFkZdpmbze9c6pT883rE1i64TJd4wbz9x/w6I2DmSZVI9TJa6M9jgGE952QsOY
  • 5
    and what about private key converting? Commented Jul 23, 2013 at 15:17
  • @ДМИТРИЙМАЛИКОВ - why would that matter? I tried it and it seems to work for either the private or public keys.
    – slm
    Commented Jul 23, 2013 at 15:23
  • 1
    Not sure that it returns valid private key for me: $> a="$(ssh-keygen -e -f ~/.ssh/id_rsa)m"; b="$(ssh-keygen -e -f ~/.ssh/id_rsa.pub)m"; md5sum <<< $a; md5sum <<< $b ce615aa3e39e274d0bd81064399cedf8 - ce615aa3e39e274d0bd81064399cedf8 -. Hashes of original files are different, obv. Seems to be that it returns public key for private or public input key. Commented Jul 23, 2013 at 15:28
  • @ДМИТРИЙМАЛИКОВ - see my updates to the answer. You're correct that ssh-keygen is giving back public keys. I've worked out a method based on additional research. LMK if it's acceptable.
    – slm
    Commented Jul 23, 2013 at 18:47
  • 1
    puttygen attributes can be tricky: puttygen <OpenSSH_priv_key> -O public -o id_rsa_ssh2_puttygen{.pub} (-O stands for output-type and -o for output-file). That generates ssh2 private and public keys from an OpenSSH 7.0 generated rsa 2048 bits private key. Not working on Win Phone 7.5 client (*The SSH Client by Tommi Pirttiniemi). But thanks to @ДМИТРИЙМАЛИКОВ and @slm for a great answer anyway. @Otheus puttygen comes with putty on Arch.
    – tuk0z
    Commented Oct 14, 2015 at 19:21

ssh-keygen will not export a private key in pem format, but it will convert an existing openssh private key to pem format, overwriting the original. All you have to do is edit the password.

The command to convert your ~/.ssh/id_rsa file from OpenSSH format to SSH2 (pem) format is:

ssh-keygen -p -f ~/.ssh/id_rsa -m pem

Then supply the (old) and new passphrase at the prompt. They can be the same, or even both be blank. Or you can supply them on the command-line using the -P (old passphrase) and -N (new passphrase) options. For example, if the passphrase is blank, and you want to keep it that way:

ssh-keygen -p -P '' -N ''-f ~/.ssh/id_rsa -m pem

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .