This howto demonstrates how to convert an OpenSSL key to a public/private OpenSSH key-pair.
The motivation for converting this is simple — dual use. That is to say, any user or application that has been issued a certificate can now use their SSL-based credentials for both SSL- and SSH-based authentication.
Requirements
You’ll need a valid certificate and private key — actually only the key is required. This recipe assumes that your certificate and key will have the names user-crt.pem and user-key.pem, respectively. If your key is encrypted (which it should be), you’ll also need to have it’s passphrase handy.
You’ll need a shell account on a system that supports OpenSSH logins using public/private key authentication.
Solution
The solution is to extract the public key from the private key using ssh-keygen, copy the new key-pair into place, and test them out.
1. Copy the private SSL key to ~/.ssh/id_ssl.
$ cp user-key.pem ~/.ssh/id_ssl
$ chmod 600 ~/.ssh/id_ssl
2. Extract the public SSH key using ssh-keygen.
$ ssh-keygen -y -f ~/.ssh/id_ssl > ~/.ssh/id_ssl.pub
$ chmod 600 ~/.ssh/id_ssl.pub
3. Add the public key to your authorized_keys
$ cat ~/.ssh/id_ssl.pub >> ~/.ssh/authorized_keys
4. Test the new key by attempting to SSH to localhost.
$ ssh -i ~/.ssh/id_ssl localhost
At this point, you’ll need to enter your passphrase (assuming you had one), and if all goes well, you’ll be sitting at a new shell prompt.
5. Remove the test key from your authorized_keys file.
In theory, a single certificate and key issued to an employee would be sufficient to access all participating SSL- and SSH-based resources in a given environment (or perhaps the entire company).
This post is based on an original recipe by Klayton Monroe.
Related posts:
- SSL: Verifying that a Certificate matches a Private Key
- SSH Key for Login Without Password
- Openssl to create an unencrypted key from an encrypted one (Remove password)
- Howto Convert Text File From UTF-8 to ISO-8859-1 Encoding
- Howto Create Generate a Certificate Signing Request
- Sending Spam with SWT
- SSL Certificates Review: What to Buy
- OpenSSL CSR Wizard
- OpenSSH: Disabled Reverse DNS Lookup
- GnuPG/GPG: Exporting your Public Key