ssh: Error loading key "./id_rsa": invalid format

Question

For some reason one of my ssh keys "just broke" - it just stopped working:

$ ssh-add ./id_rsa
Error loading key "./id_rsa": invalid format

Copying the key inside a clean VM, the key does work. Even with the exact same ssh version (OpenSSH_7.8p1, OpenSSL 1.1.0i-fips 14 Aug 2018 on Fedora 28). So it must be related to some config on my system I assume.

# cat ./id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,...

...
-----END RSA PRIVATE KEY-----

Also peculiar: GNOME somehow manages to add the key on login with seahorse. Then ssh-add -L does list the key but it is not usable:

sign_and_send_pubkey: signing failed: agent refused operation

Answer 1

I was getting the same error message when passing in the private key through a CI pipeline variable in Gitlab.

The error was caused by not having a newline character at the end of the variable and was fixed by manually adding it.

Answer 2

Traditionally OpenSSH used the same private key format is identical to the older PEM format used by OpenSSL. (Because it uses OpenSSL for parsing the key, it will accept the newer PKCS#8 format as well.)

So the issue can be one of:

2. Your OpenSSL version refuses to load this key format. Perhaps it has accidentally enabled FIPS mode and refuses any algorithms except those part of its original FIPS validation?

   Try loading the key into the openssl command-line tool (which, yes, might also be linked to a different libcrypto, and you should check with ldd):

   openssl rsa -noout -text < id_rsa
   openssl pkey -noout -text < id_rsa
   

   Try converting it to PKCS#8 format:

   umask 077
   openssl pkey < id_rsa > id_rsa.pkcs8
   ssh-add id_rsa.pkcs8
   

3. Your OpenSSH has been built without OpenSSL support. Even though ssh -V says the support was enabled, that does not automatically mean the ssh-add binary is the same – it might come from a different partial installation.

   Use type -a ssh and type -a ssh-add to compare installation locations.

   Once you know the path, use ldd /usr/bin/ssh-add to verify that it's linked to libcrypto.so (the OpenSSL cryptographic library).

---

If nothing works at all, try converting your key to the new OpenSSH-proprietary format using... PuTTY. Install the putty package for Fedora, and use:

puttygen id_rsa -o id_rsa.newformat -O private-openssh-new
ssh-add id_rsa.newformat

---

Also peculiar: GNOME somehow manages to add the key on login with seahorse.

Older GNOME Keyring versions have an internal copy of the SSH agent code and are independent from the system OpenSSH. So they will accept keys that your OpenSSH won't. (But on the other hand, this means severe lagging in terms of feature support (such as Ed25519 keys), and the latest GNOME Keyring just uses the system ssh-agent instead.)

Answer 3

In my case, the problem was caused by incorrect end of line characters in id_rsa file. After copying file content, Windows text editor wanted to help me and converted EOLs to CR LF.

Answer 4

In my case, I just copied id_rsa private key but not the public part id_rsa.pub. It worked but complained with 'invalid format' each time I did server operations. Copying id_rsa.pub as well solved the problem.

Answer 5

I recently had this problem, and in my case it was due to having an invalid certificate (i.e. $HOME/.ssh/id_rsa-cert.pub), which confusingly gave this same error even though my private key was still valid and SSH continued to work.

It was fixed by either removing the invalid (in my case, zero-sized) cert file, or replacing it with a valid certificate, as the case may be.

Answer 6

In my case, on Windows, the solution was to use the Puttygen option Conversions > Export SSH key (force new file format)

Answer 7

I was struggling with this issue and it ended up being extra newlines before and after the
-----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- lines respectively; removing them fixed it and now works fine.

hernandanielg@laptop:~$ diff -c id_rsa .ssh/id_rsa
*** id_rsa    2022-04-26 06:41:51.650982783 -0500
  --- .ssh/id_rsa   2022-04-26 06:39:47.971676083 -0500

*** 1,5 ****
    -----BEGIN RSA PRIVATE KEY-----

Proc-Type: 4,ENCRYPTED

--- 1,4 ----

*** 52,56 ****
    somehash

-----END RSA PRIVATE KEY-----

--- 51,54 ----

Answer 8

Because I come back to this question and often forget what to do on a Mac. You can also run: ssh-add --apple-use-keychain {path_to_ssh_key} to get the error: Load key ... invalid format? git error fixed.

Answer 9

Oh boy, just went through doing this for a team member... and the problem proved to be puttygen not doing things the nice way. I was finally able to fix it by using Windows Powershell and the command:

ssh-keygen -t rsa

it was an instant fix !