I have been experimenting with OpenSSL and OpenSSH and I have been unable to sign and verify using RSA key pairs.

I did the following

Generated key pairs:

$ ssh-genkey -b 2048 -t rsa <key-name>

I then created a message digest by:

$ openssl sha1 -sign <key-name> -out rsasign.bin ~/tmp/test.txt

I attempted to verify the signature using the corresponding public key:

$ openssl sha1 -verify <key-name>.pub -signature rsasign.bin ~/tmp/test.txt

Unfortunately, trying this returns the error:

unable to load key file

Can anyone see any problem with what I'm doing?



Firstly, I'm assuming you mean ssh-keygen, not ssh-genkey (also, my version requires the path be specified interactively, not via the command line, but the output's the same). :)

The problem is that OpenSSL uses a different format for public keys than SSH. You can still use SSH-generated keys, but you need to get the public key in a format that OpenSSL can understand. You can do this with the following command:

openssl rsa -in <key-name> -pubout -out public-key.pem

Where public-key.pem is the new file you'll create. Once I did this, the verification command you mentioned ran successfully, outputting only Verified OK for my test file.

Note that the above command requires the private key, not the public key; you can convert an SSH-style public key to an OpenSSL-style public key by running:

ssh-keygen -f <key-name>.pub -e -m public-key.pem

Where public-key.pem is once again the new file you'll create.

  • Thanks for the response. I'll try it out when I get a chance, but I'm pretty sure you got it. – Daeden Oct 14 '13 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.