Complete Guide to Converting OpenSSH Private Key to RSA PEM Format

Differences Between OpenSSH Private Key Format and RSA PEM Format

In modern OpenSSH versions, the default generated private keys use the new OpenSSH private key format, with file header -----BEGIN OPENSSH PRIVATE KEY-----. This format offers better security and extensibility compared to the traditional RSA PEM format (file header -----BEGIN RSA PRIVATE KEY-----), but some legacy applications may only support the traditional format.

Format Conversion Using ssh-keygen

OpenSSH provides the built-in key management tool ssh-keygen, which can perform format conversion using the following command:

ssh-keygen -p -N "" -m pem -f /path/to/your/id_rsa

The parameters in this command have the following meanings:

• -p: Requests changing the passphrase of the private key
• -N "": Sets the passphrase to empty (no passphrase)
• -m pem: Specifies the output format as PEM format
• -f /path/to/your/id_rsa: Specifies the path to the private key file to be converted

Detailed Operation Steps

Before performing the conversion operation, it is strongly recommended to backup the original key file:

cp ~/.ssh/id_rsa ~/.ssh/id_rsa.backup

Then execute the conversion command:

ssh-keygen -p -N "" -m pem -f ~/.ssh/id_rsa

The system will prompt for the current key's passphrase (if set). After conversion completes, verify the new format using a text editor:

head -n 1 ~/.ssh/id_rsa

The output should display: -----BEGIN RSA PRIVATE KEY-----

Public Key Handling Instructions

The public key file (id_rsa.pub) does not require any conversion. The OpenSSH public key format is standardized and independent of the private key format. Public key files typically contain a single line of text in the format: ssh-rsa AAAAB3Nza... user@host, which is widely supported and can be directly used for server authentication configuration.

Security Considerations

Setting an empty passphrase reduces key security. If high security is required, it is recommended to set a strong passphrase:

ssh-keygen -p -m pem -f ~/.ssh/id_rsa

The system will prompt for a new passphrase. Additionally, ensure the private key file permissions are set to 600:

chmod 600 ~/.ssh/id_rsa

Compatibility Analysis and Application Scenarios

According to the reference article case, certain specific applications (such as some versions of Terraform, Ansible, or other legacy tools) may only support traditional RSA PEM format. This compatibility issue is particularly common after macOS system upgrades, as newer OpenSSH versions default to the new format.

The converted RSA PEM format private key can be used for:

• Legacy SSH clients and servers
• APIs and SDKs requiring PEM format
• Certain cloud services and container orchestration tools
• Legacy automation scripts and configuration management tools

In-depth Technical Principle Analysis

The OpenSSH private key format uses a custom serialization scheme, while the RSA PEM format is based on ASN.1 encoding and Base64 encapsulation. Both formats mathematically represent the same RSA key parameters but differ in serialization methods. The ssh-keygen tool during conversion will:

1. Parse the OpenSSH format key data
2. Extract core RSA key parameters including modulus, public exponent, and private exponent
3. Re-encode according to PKCS#1 standard into ASN.1 structure
4. Perform Base64 encoding and add PEM encapsulation headers and footers

This process ensures mathematical equivalence of the key while meeting format requirements of different applications.