75

I have a .key file which is PEM formatted private key file. I didn't make this file but I got this from somewhere.

I wanted to see its MD5 hash with openssl tool like below command.

openssl rsa -in server.key -modulus -noout

But this generates below error.

unable to load Private Key
13440:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:648:Expecting: ANY PRIVATE KEY

Here's some asn1parse of the .key file.

openssl asn1parse -in server.key
0:d=0  hl=4 l= 603 cons: SEQUENCE
4:d=1  hl=2 l=   1 prim: INTEGER           :00
7:d=1  hl=3 l= 129 prim: INTEGER           :C141201603899993919CBAA56985E9C7
C6A2AF713A02F5FE88D38CEFBED9304599689280B84B0AB577A9719CA20DDA1246A894AF397A2C57
EE5A582B036CC367E3667454DCD82DBDBF187C35FE39F61C71B517DDDF576F5471B4EC2E045E0F9D
619F5616C4E832F00CBD0DBF41B4BA3CBC4B4B603AE1FE61965917DA732E0DEF
139:d=1  hl=2 l=   3 prim: INTEGER           :010001
144:d=1  hl=3 l= 128 prim: INTEGER           :1687B9AE67562CEDEBDD7A531B84CDB7
093CE138519B93C34B7F626076FF0A262B16EA71904ACB6251A39307C04ADE202055BA13DD9F1539
6123EE408183361A9BC08B9413FA360EA928E48CC3F52B33ACF2980758F02BA2139F652F30A257C2
2E45D7C25835FC4D22B9ECECC12AB632318D4F47E1EBDAD9781B96BCFF03A2D1

 ...

Is there anything more I can try?

||||||
  • 2
    What is the exact header/footer of the PEM file? You can get this error if you are sending in a public key. Also, the command you listed will not give the MD5 hash. It will give the modulus of the key. – gtrig Aug 27 '13 at 21:29
  • I had used scp to copy the file from Windows to Ubuntu. To fix it, I deleted the file on Ubuntu, created a new empty file there, and used vim and then pasted in the correct contents. – Ryan Nov 3 '19 at 1:47

10 Answers 10

47

I changed the header and footer of the PEM file to

-----BEGIN RSA PRIVATE KEY-----

and

-----END RSA PRIVATE KEY-----

Finally, it works!

||||||
  • 1
    You can also add -inform pem to the command to get the same result. E.g. openssl rsa -in server.key -modulus -noout -inform pem. – Simon Woodside Dec 22 '18 at 4:13
  • Check stackoverflow.com/questions/54994641/… if it solves your problem – qstack Jan 18 at 0:41
  • Something is already working correctly with the "bad" format (i.e. unchanged headers), so, this is a makeshift solution, bound to break something that was already working fine, like, a reverse proxy that is not crashing for the lack of those manually-edited headers and footers. Yipes! – alejandrob Jan 30 at 2:26
34

Open the key file in Notepad++ and verify the encoding. If it says UTF-8-BOM then change it to UTF-8. Save the file and try again.

||||||
  • What if I'm using a mac? – Ernest Zamelczyk Sep 20 '19 at 10:17
  • Use Visual Studio Code - you can easily change the encoding using the bottom toolbar! – Luca Ghersi Jan 21 at 17:25
  • Oh my good God! THANK YOU! I would've never figured that out by trial and error, fixed the issue for me! – Mikael Dyreborg Hansen Apr 15 at 12:48
24

your .key file contains illegal characters. you can check .key file like this:

# file server.key

output "server.key: UTF-8 Unicode (with BOM) text" means it is a plain text, not a key file. The correct output should be "server.key: PEM RSA private key".

use below command to remove illegal characters:

# tail -c +4 server.key > new_server.key

The new_server.key should be correct.

For more detail, you can click here, thanks for the post.

||||||
  • 1
    file server.key this command helped me to get the issue. Thanks. – itsHarshad Feb 6 at 5:12
6
> I have a .key file which is PEM formatted private key file.
> ...
> Here's some asn1parse of the .key file...

That it appears OK with asn1parse leads me to believe its not PEM encoded.


Is there anything more I can try?

Because it appears to be ASN.1, try:

$ openssl rsa -in server.key -inform DER -modulus -noout

Notice the -inform DER to switch between encodings.

||||||
5

Remove any whitespace at the start of the .key file.

||||||
4

Create CA certificate

openssl genrsa -out privateKey.pem 4096
openssl req -new -x509 -nodes -days 3600 -key privateKey.pem -out caKey.pem
||||||
2

I'm on Windows 10 and I saved my key with Windows1252 encoding and it worked for me. On another StackOverflow question some people were fixing this with UTF-8 with BOM.

In other words, it may be the file encoding.

||||||
1

May be the private key itself is not present in the file.I was also faced the same issue but the problem is that there is no private key present in the file.

||||||
0

Resolution on my side. Change Encoding to UTF8 without BOM

||||||
-6

Why not using cetificate bot

yum install epel-release

yum install certbot-nginx

Obtaining a Certificate

certbot --nginx -d example.com -d www.example.com

||||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.