Is it possible to use an exported OpenPGP private key to sign a file via OpenSSL?

I've tried this:

$ gpg2 --export-secret-keys --no-armor 84E2C2E5 > secret.key
$ openssl rsautl -sign -in testfile -inkey secret.key -out test.sign

But that gives me this error:

unable to load Private Key 140543167485592:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:701:Expecting: ANY PRIVATE KEY

What am I doing wrong?

2 Answers 2


While OpenPGP and X.509 mostly share the same cryptographic algorithms, they have completely different representations of the key material. GnuPG (or to be more specific, gpg; gpgsm implements S/MIME and X.509 but not OpenPGP and is also part of GnuPG) does not "speak" X.509, OpenSSL does not support OpenPGP.

While you could well extract the numbers forming the keys and then construct a new key of the other format, these would still seem like different keys: due to the different protocols you cannot read messages encrypted in the other system, you cannot verify signatures issued by this. Even the keys are not obviously comparable, key identifiers are constructed differently, and finally the two systems share different trust systems.

To wrap up: theoretically you could construct a new key (not really convert it, as meta information is lost and other information is missing). There is no actual use in doing so, thus nobody cared about writing proper tooling for the process.


You need to convert the key to the correct format -

gpg2 --export-secret-keys
     --export-options export-reset-subkey-passwd,export-minimal,no-export-attributes 
     --no-armor 84E2C2E5 | openpgp2ssh 84E2C2E5 > id_rsa

Why are you trying to do this? Why not just sign the document with gpg?

gpg2 --sign document.doc
  • I'm trying to examine if a "gpg-signature" differs from an "openssl-signature". Your first line does not work for me. Although the id_rsa-file is generated, openpgp2ssh says: "We cannot handle encrypted secret keys. Skipping!" And openssl rsautl -sign -in test2 -inkey id_rsa -out test.sign does not work either. Nov 13, 2017 at 14:44
  • @user1511417 see update to arguments to export encrypted.
    – Hector
    Nov 13, 2017 at 14:48
  • It's still not working: gpg2 does not know the export option 'export-reset-subkey-passwd' Nov 13, 2017 at 14:52
  • I've version gpg (GnuPG) 2.1.11 installed here. Nov 13, 2017 at 14:53
  • 1
    Also look at OpenSSL's CMS and S/MIME signatures, both detached/clear and embedded, which are a much closer analog to GPG/PGP. Nov 14, 2017 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .