How to convert SSH public key from PEM to DER format?

Question

I'd like to convert an existing public key (generated using ssh-keygen) from PEM-format to DER-format

I tried:

openssl rsa -in ~/.ssh/id_rsa.pub -inform PEM -pubin -outform DER -out ~/.ssh/id_rsa.pub.der

Unfortunately this gives the following error:

unable to load Public Key
139946985690784:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: PUBLIC KEY

The file ~/.ssh/id_rsa.pub contains a public key; cat ~/.ssh/id_rsa.pub gives:

ssh-rsa ...... user@machine

What am I doing wrong?

Solution

OpenSSH public key format is different from PEM format. You have to run ssh-keygen to convert it.

ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PEM >pubkey.pem

Then convert it to DER format using openssl rsa.

openssl rsa -RSAPublicKey_in -in pubkey.pem -inform PEM -outform DER -out ~/.ssh/id_rsa.pub.der -RSAPublicKey_out

Note that you also have to specify -RSAPublicKey_in (not -pubin) and -RSAPublicKey_out to keep it to be RSA Public Key (PKCS#1).

Comments

[nakajuice]

Doesn't work in MacOS: unknown option -RSAPublicKey_in

[Leo]

Works on MacOS 10.14.6 with openssl 2.6.5