I'm having trouble understanding how to use the openssl tool to convert rsa public keys.

This works fine for a private key

$ openssl rsa -in id_rsa -pubout -outform DER > out
writing RSA key

If I only have a public key, I thought I'd be able to do the same and just add "-pubin". But I get a cryptic error complaining it was expecting a public key ... but that is what I gave it.

$ openssl rsa -pubin -in id_rsa.pub -pubout -outform DER > out
unable to load Public Key
140028314654360:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:701:Expecting: PUBLIC KEY

In case I was supposed to use pkey instead I tried that and I still get that error, but without the second line

$ openssl pkey -pubin -in id_rsa.pub -pubout -outform DER > out
unable to load Public Key

Any ideas?


OpenSSL does not understand OpenSSH-format public keys. (It is mostly just a coincidence that they both use the same private key format, too – in fact, recent OpenSSH started using a different, incompatible one.)

With recent OpenSSH, you can use ssh-keygen -f id_rsa -e -m PEM to get a PKCS#1 file.

Similarly, ssh-keygen -f id_rsa -e -m PKCS8 will give you the key in PKCS#8 format.

You can also extract OpenSSL-format public key from the private file using -in id_rsa -pubout.

  • I need to find a solution that only uses the public key. (Sadly, I currently resorted to just converting to DER format in a small python script. I'd still like to understand how to use the command line tools correctly though.) ssh-keygen -f id_rsa.pub -e -m PEM > tmp.pem completes fine. Then openssl rsa -pubin -in tmp.pem -pubout -outform DER > out still gives me the error about having trouble loading a public key. – BuddyJohn Sep 28 '16 at 8:50
  • Huh, it worked with PKCS8 though. – BuddyJohn Sep 28 '16 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.