How to convert SSH public keys between SSH2 and OpenSSH formats

Different SSH tools can reject the same public key when the text wrapper is in the wrong format. A server or appliance may request a one-line OpenSSH public key, while another interface exports an SSH2 block using the RFC 4716 public-key file format. Converting the public key changes that wrapper without creating a new key pair.

The ssh-keygen utility exports an OpenSSH public key with -e and imports an SSH2 public key with -i. Adding -m RFC4716 makes the SSH2 format explicit even though it is the default conversion format in current OpenSSH releases.

Format conversion should use the public .pub file whenever possible. Comments, headers, and line wrapping can change during conversion, so keep the original file untouched and compare the SHA256 fingerprint after importing the key back to OpenSSH format.

1. Check the fingerprint of the original OpenSSH public key.

   $ ssh-keygen -l -f ~/.ssh/id_ed25519.pub
   256 SHA256:js6g+JiV/uP2STjPJYfXSxwbA7lHDC1IHN2ex3X5sfc user@host (ED25519)

   Use the existing .pub file that belongs to the private key. If the public file is missing, recreate it from the private key or generate a new key pair before converting.
   Related: How to extract a public key from an SSH private key
   Related: How to create an SSH key pair

2. Export the OpenSSH public key to an SSH2 public-key file.

   $ ssh-keygen -e -m RFC4716 -f ~/.ssh/id_ed25519.pub > id_ed25519_ssh2.pub

   The -e option exports a public key, and -m RFC4716 writes the SSH2 public-key block format.

3. Inspect the saved SSH2 public-key block.

   $ cat id_ed25519_ssh2.pub
   ---- BEGIN SSH2 PUBLIC KEY ----
   Comment: "256-bit ED25519, converted by user@host from OpenSSH"
   AAAAC3NzaC1lZDI1NTE5AAAAIJ0QRJrLUSz2CyZqmDp1CNk++ee4f1g9pg3fgkvft4GU
   ---- END SSH2 PUBLIC KEY ----

   The begin and end markers identify the RFC 4716 wrapper. The comment line is metadata and may change without changing the public key.

4. Import the SSH2 public-key file back to OpenSSH one-line format when a destination requires that layout.

   $ ssh-keygen -i -m RFC4716 -f id_ed25519_ssh2.pub > id_ed25519_openssh.pub

   The -i option imports a key from the format named by -m and writes the OpenSSH public-key line to standard output.

5. Display the imported OpenSSH public key.

   $ cat id_ed25519_openssh.pub
   ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0QRJrLUSz2CyZqmDp1CNk++ee4f1g9pg3fgkvft4GU

   An OpenSSH public-key line starts with the key type, followed by base64 key data and an optional trailing comment.

6. Verify that the imported key keeps the original fingerprint.

   $ ssh-keygen -l -f id_ed25519_openssh.pub
   256 SHA256:js6g+JiV/uP2STjPJYfXSxwbA7lHDC1IHN2ex3X5sfc no comment (ED25519)

   If the fingerprint differs from the source key, stop and repeat the conversion from the trusted original public key file.