I have generated a private/public key pair using Putty. I have a private key file with extension .pem and public key file with extension .pub.

Now I want to create a certificate from that and import into windows "trusted root certification authorities". The reason for that is because I need to use private key to connect to SFTP and I don't want to store the private key on disk.

I tried openSSL command shown below but it's failing with the error - "No certificate matches private key"

openssl pkcs12 -export -out MyCert.pfx -inkey private.pem -in public.key

How to resolve that? And get a certificate file containing those two keys inside it?

  • SFTP is basically just FTP over SSH. So if you have an SFTP server you need to connect to, I believe you just put your public key (.pub) on it, much like you would do with an SSH server you need to connect to. Your private key stays on your client machine's disk just like with SSH. It sounds like your existing .pem does not contain a certificate. You'll need to create a Certificate Signing Request (CSR) and have a Certificate Authority sign it (i.e. issue a certificate based on the CSR). You can use OpenSSL to do all those things, but you shouldn't need a certificate to do SFTP securely. – Spiff Sep 21 '20 at 6:38
  • 1
    What SFTP client are you using? – user1686 Sep 21 '20 at 6:46
  • I have given the public key to the people who host the SFTP server. The private key is on my machine and I need to connect to the SFTP server from my machine. I generated .pem file from Putty so you are probably right, it doesn't has the certificate. I am using a C# library called Renci.SshNet to connect to SFTP server and transfer file. I just don't want to store private key on the machine. So a cert would be slightly better. – Varun Sharma Sep 21 '20 at 7:25
  • SSH.NET does not support certificates either. I've updated my answer. – Martin Prikryl Sep 21 '20 at 9:29
  • 1
    @Martin: I've seen the Windows CAPI certificate store and .p12 files being used for storing raw keypairs that were just wrapped in a dummy certificate even though the protocol did not use X.509 certificates at all (e.g. the Windows DNS Server stores DNSSEC keys that way), and I could swear I had used an SFTP client that did the same for SSH keypairs. So I think that's what OP meant – not OpenSSH certificates. – user1686 Sep 21 '20 at 17:51

In general SSH does not use certificates. It uses simple key pairs. There are some proprietary extensions of SSH that use certificates. Most notably the OpenSSH.

PuTTY does not support certificates at all. SSH.NET does not support certificates either. While OpenSSH does, those are special certificates. I believe they are not compatible with Windows certificates store. And even if they were, I'm sure OpenSSH does not use Windows certificates store anyway. So you would have to store the certificate into a file anyway.

If you want to avoid storing the key pair into a file, you can hard-code it into your C# binary.
For an example, see a Stack Overflow question about loading SSH private key from configuration string using SSH.NET.

  • PuTTY supports certificates, it just has to be compiled in. A custom compiled version of PuTTY (PuTTY-CAC) is what's used by the US DoD [Dept of Defense]. SettingsConnectionSSHCertificate – JW0914 Sep 21 '20 at 13:00
  • @JW0914 Hardware certificates are yet another thing than OpenSSH certificates. And still, PuTTY does not support certificates on its own. – Martin Prikryl Sep 21 '20 at 13:20
  • ??? PuTTY does support certificates on it's own, as PuTTY-CAC demonstrates, it's just not built-in by default - anyone can compile PuTTY with certificate support as it's opensource (this is similar to software for BSD/Linux, such as nano, which doesn't have all enabled options compiled in by default, with the user able to compile nano with any of the extra offered features). As to OpenSSH certificates, no (it might be a compilable option), but GPG certs yes (GPG subkeys are a more efficient means to manage SSH keys & certs anyway since they can be loaded onto hardware keys [YubiKey]) – JW0914 Sep 21 '20 at 13:28
  • @JW0914 I do not agree. PuTTY does not. PuTTY-CAC (a different project) does. Anyway, let's stop this discussion, as it's irrelevant to OP's question. If you have a better answer, please post one. – Martin Prikryl Sep 21 '20 at 13:37
  • It's not an agree/disagree issue, it's simply a fact: PuTTY IS opensource (source code: BSD/Linux || Windows || Git) and certificate support IS a compilable option. – JW0914 Sep 21 '20 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.