Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to do an asymmetrical file encryption:

openssl genrsa -des3 -out private.key 4096
openssl rsa -in private.key -pubout -out public.key
openssl rsautl -encrypt -pubin -inkey public.key -in a -out b

But I already have a key pair in my ~/.ssh directory, so how do I use this instead of generating new keys? Simply switching filenames gives an error:

$ openssl rsautl -encrypt -pubin -inkey ~/.ssh/id_rsa.pub -in a -out b
unable to load Public Key

public.key starts with BEGIN PUBLIC KEY while ~/.ssh/id_rsa.pub starts with ssh-rsa, so I figure it's some sort of format problem.

How can I generate a ~/.ssh key that openssl understands, or how can I instruct openssl to understand the keys I have in ~/.ssh?

share|improve this question

1 Answer 1

You can convert your existing ssh key to PKCS#8 with the following:

mv ~/.ssh/id_rsa{,.old}
umask 0077
openssl pkcs8 -topk8 -v2 des3 -in ~/.ssh/id_rsa.old -out ~/.ssh/id_rsa

After testing the converted key, you can then delete the original.


share|improve this answer
Tried this (entering a blank password for the converted private key). When I tried to ssh (using the new private key), OS X displayed a GUI dialog asking for password (in parallel with the terminal asking for a password). Further suggestions? –  forthrin May 29 '13 at 15:25
I haven't tried using it with a blank passphrase, but with a passphrase it works great on OS X (10.8.3) and CentOS. –  demure May 29 '13 at 15:29
Tried it again and it worked. But your suggestion is for converting the private key, while the encryption requires the public key. How do I convert the public key? –  forthrin May 29 '13 at 20:15
No, you should be encrypting with your private key (which only you have) and letting the recipient have access to your public key to decrypt the information. –  Dave Mulligan Apr 16 '14 at 4:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.