Mdthbs

I'm having an issue generating a public key that the openssl PEM_read_bio_RSA_PUBKEY() function can consume. I keep getting errors.

Obviously I cannot simply use the ASCII string in the ssh-keygen <>.pub key file as it is in SSH file format or I perhaps SubjectPublicKeyInfo structure.

Here's the key gen code: ssh-keygen -t rsa -b 1024 -C "Test Key"

I found a converter in php on the web which will convert the contents of the public key into a base64 PEM ASCII string format. However the function still doesn't like it.

The Openssl documentation states:

1. “RSA_PUBKEY() function which process a public key using an EVP_PKEY structure”


2. “RSA_PUBKEY functions also process an RSA public key using an RSA structure”

How do I get my OpenSSH public key into either format that the OpenSSL function will consume it?

OK!

So I walked into this thinking "Easy, I got this." Turns out there's a whole lot more to it than even I thought.

So the first issue is that (according to the man pages for OpenSSL (man 3 pem)), OpenSSL is expecting the RSA key to be in PKCS#1 format. Clearly this isn't what ssh-keygen is working with. You have two options (from searching around).

If you have OpenSSH v. 5.6 or later (I did not on my laptop), you can run this:

ssh-keygen -f key.pub -e -m pkcs8

The longer method of doing this is to break apart your SSH key into it's various components (the blog entry I found some of this in accuses OpenSSH of being "proprietary", I prefer to call it "unique") and then use an ASN1 library to swap things around.

Fortunately for you, someone wrote the code to do this:

https://gist.github.com/1024558

Assuming you have the SSH private key id_rsa, you can extract the public key from it like so:

openssl rsa -in id_rsa -pubout -out id_rsa.pub.pem

I realize the OP asked about converting a public key, so this doesn't quite answer the question, however I thought it would be useful to some anyway.

Note also that this command results in a PEM public key format, which is generally what OpenSSL expects. The answer by Brian, on the other hand, results in a file in RSAPublicKey format, which is not the normal format expected by OpenSSL (though later versions can apparently read it via the -RSAPublicKey_in flag). To convert you can do this:

openssl rsa -RSAPublicKey_in -in id_rsa.rsapub.pem -pubout -out id_rsa.pub.pem

The format you want is what ssh-keygen calls PKCS8. So the following command will produce the desired output:

ssh-keygen -f key.pub -e -m pkcs8

From the ssh-keygen man page:

-m key_format

         Specify a key format for the -i (import) or -e (export) conversion 

         options.  The supported key formats are: 

         ``RFC4716'' (RFC 4716/SSH2 public or private key), 

         ``PKCS8'' (PEM PKCS8 public key) or 

         ``PEM'' (PEM public key).  

         The default conversion format is ``RFC4716''.

Similar to Amal Chaudhuri's method below, this is what worked for me. I needed to create a pem file from the ssh public key I'd generated for my SFTP client (Cyberduck).

openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem

Another way to do this from another site. Posting this in case you need another method. Works very well.
http://www.chatur.com.np/2011/01/convert-openssh-rsa-key-to-pem-format.html

openssl dsa -in ~/.ssh/id_dsa -outform pem > id_dsa.pem