118

Let me explain my question first. I bought a certificate from a CA and used the following format to generate the csr and the private key:

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

When I open the server.key file, I see that it begins with "-----BEGIN PRIVATE KEY-----"

I use the SSL cert on my server and everything looks fine.

Now I want to upload the same cert to AWS IAM so that I can use it for by beanstalk load balancer. I use the following command from this aws doc http://docs.aws.amazon.com/IAM/latest/UserGuide/InstallCert.html#SubmitCSRCertAuth

iam-servercertupload -b public_key_certificate_file  -k privatekey.pem -s certificate_object_name

I change the cert file names as required but keep getting this error: "400 MalformedCertificate Invalid Private Key."

The interesting thing is, on the aws doc page, the sample private key that they show starts with "-------Begin RSA Private Key--------"

Is there a way to convert my private key to an RSA private key using openssl?

3 Answers 3

197

Newer versions of OpenSSL say BEGIN PRIVATE KEY because they contain the private key + an OID that identifies the key type (this is known as PKCS8 format). To get the old style key (known as either PKCS1 or traditional OpenSSL format) you can do this:

openssl rsa -in server.key -out server_new.key

If you are using OpenSSL 3, you need to add -traditional :

openssl rsa -in server.key -out server_new.key -traditional

Alternately, if you have a PKCS1 key and want PKCS8:

openssl pkcs8 -topk8 -nocrypt -in privkey.pem
8
  • 1
    This is also the solution to getting weird error messages like Invalid PEM structure, '-----BEGIN...' missing. from tools like Cyberduck while pure SSH with the same key is working.
    – Daniel
    Oct 18, 2013 at 5:58
  • 1
    Thank you! I was getting A client error (MalformedCertificate) occurred when calling the UploadServerCertificate operation: Unable to parse certificate. Please ensure the certificate is in PEM format. and running this on my private key fixed it!
    – philfreo
    Jun 19, 2014 at 23:07
  • 4
    For reference: see stackoverflow.com/q/20065304/53974 for a more complete explanation. Jul 8, 2015 at 12:47
  • 2
    how do we do the opposite of this? I need a Private Key from an RSA Private Key?
    – edthethird
    Aug 31, 2015 at 15:06
  • 2
    openssl pkcs8 -topk8 -nocrypt -in privkey.pem will write a PKCS8 to STDOUT Aug 31, 2015 at 16:28
34

This may be of some help (do not literally write out the backslashes '\' in the commands, they are meant to indicate that "everything has to be on one line"):

Which Command to Apply When

It seems that all the commands (in grey) take any type of key file (in green) as "in" argument. Which is nice.

Here are the commands again for easier copy-pasting:

openssl rsa                                                -in $FF -out $TF
openssl rsa -aes256                                        -in $FF -out $TF
openssl pkcs8 -topk8 -nocrypt                              -in $FF -out $TF
openssl pkcs8 -topk8 -v2 aes-256-cbc -v2prf hmacWithSHA256 -in $FF -out $TF

and

openssl rsa -check -in $FF
openssl rsa -text  -in $FF
1
  • 2
    The "graphml" file of the image (which can be edited with yworks yed for example) can be found here Apr 7, 2018 at 9:40
29

To Convert BEGIN OPENSSH PRIVATE KEY to BEGIN RSA PRIVATE KEY:

ssh-keygen -p -m PEM -f ~/.ssh/id_rsa
4
  • 3
    This is exactly what I needed. Thanks!
    – RossD
    Sep 5, 2019 at 18:46
  • This behaviour is documented indirectly on the ssh-keygen manpage, but the usage of the -m flag is actually not mentioned for other operation modes than -i and -o
    – ikrabbe
    Jun 19, 2020 at 13:45
  • 5
    Beware that this would overwrite the key file. So make a backup first.
    – Vadzim
    Jun 22, 2021 at 20:41
  • Is there a way to specify a new output file with this command?
    – Eddie
    Jul 7 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.