5

i have my access key, secret key, and the downloaded cert pem file.

i understand SSH requires a private key file in order to establish a terminal SSH connection to my instance.

what i did find through Google is that i need to use puttygen to convert my cert pem file into a private key file:

http://www.techrepublic.com/blog/datacenter/connect-to-amazon-ec2-with-a-private-key-using-putty-and-pageant/5085

however, all the instructions i found are based on a GUI puttygetn and i only have the CL version because i am running Linux Fedora 16 on my laptop. i did yum PuTTy, which came with a GUI but puttygen only has a CL version. what i tried to do in puttygen is as follows:

>puttygen cert-***.pem -o default.pem 

puttygen: error loading `cert-***.pem': file does not begin with OpenSSH key header

can anybody point what i am doing wrong and how i can use CL puttygen to convert my cert file to a private key file that is usable by SSH to connect to my instances?

thanks in advance

2 Answers 2

10

If you are running Linux at the command line, why are you needing to make a ppk with puttygen? Basically the keypair you get from AWS IS in pem format suitable for using in ssh command line.

So if you saved your .pem file from Amazon as /path/to/aws.pem, all you need to do is

ssh -i /path/to/aws.pem [email protected]
4

The ssh private key is completely different from the X.509 certificate and private key. It's a little confusing because folks often save the ssh private key generated by EC2 in a ".pem" file just like the cert and pk use.

You can't convert or use the X.509 certificate or private key for ssh as you tried to do.

You can generate an ssh private key (sometimes called a "keypair") through Amazon EC2 on the AWS console or through the AWS command line tools (ec2-add-keypair). If you are using Putty, you may still need to convert to PPK format as your referenced article describes, but you are converting the ssh key .pem file, not the X.509 private key or certificate.

If you know how to generate your own ssh key locally (or have already done so) then I recommend doing this and uploading the ssh public key to EC2.

When you run an EC2 instance, you then specify the ssh keypair name so that EC2 makes the ssh public key available to the instance, letting you securely ssh in to your new server.

2
  • thanks. i did that and uploaded the pem.pub file into AWS Console. however, when i then try to connect with the pem file, it asks me for the root passwd. could that be a problem with the particular AMI, i.e. that it was configed so that it requires the root passwd: >ssh -i aws_foampile_default.pem root@ec2-.compute-1.amazonaws.com >root@ec2-.compute-1.amazonaws.com's password:
    – amphibient
    Sep 13, 2012 at 18:23
  • 1
    Are you sure that the AMI uses "root" as the login user? It might be "ec2-user" or "ubuntu" depending on the AMI. Sep 14, 2012 at 3:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.