I just upgraded to OSX 10.9, and when trying to establish an SSH connection with public key authentication, a prompt appears asking for my SSH key password.

I initially thought that the upgrade caused the keychain to forget some passwords, so I re-entered mine. Apparently, that wasn't the cause, because the prompt kept reappearing.

I first though that I may be using the wrong password, but while the following command:

$ ssh-keygen -vvv -y -f id_rsa >| id_rsa.pub
debug3: Incorrect RSA1 identifier
debug1: key_parse_private_pem: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Enter passphrase:
debug3: Incorrect RSA1 identifier
debug1: key_parse_private_pem: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
load failed

...does not work! If I try to use openssl:

$ openssl rsa -in id_rsa -text
Enter pass phrase for id_rsa:
Private-Key: (2048 bit)

my private key is correctly decrypted and all information is printed.

What happened with the upgrade to Mavericks? How can I get my private key back in a usable state?


Apparently, the private key I was using on my machine was an old one. My key did not contain the encryption information added to the private key file if I generate a new one:

Proc-Type: 4,ENCRYPTED
DEK-Info: AES-...

To solve the problem, I decrypted the key with openssl:

$ cd ~/.ssh
$ cp id_rsa id_rsa.bck
$ openssl rsa -in id_rsa -out id_rsa

...and then re-encrypted it:

$ openssl rsa -in id_rsa -aes256 -out id_rsa
$ chmod 0600 id_rsa

And just in case, regenerate the public key as well:

$ ssh-keygen -y -f id_rsa > id_rsa.pub

I had the same problem. I solved it by moving .ssh/authorized_keys2 to .ssh/authorized_keys.

The file /etc/sshd_config explicitly contains these lines:

\# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
\# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile  .ssh/authorized_keys

This is a change from previous macosx version?

  • 1
    This problem is a different one as well. In my case I was not able to decrypt my private key. – GaretJax Nov 4 '13 at 10:46

Same problem here, my keys show the same behaviour.

I tracked the problem back to this blog post. I modified my ssh-keys the way it was described in this artice to increase security and it worked unter Mountain Lion. http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html

I assume that Apple changed somthing with openssh and the "new" version is not capable of reading the newer PKCS#8 format.

My Mavericks OpenSSH Version: OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011

I have no other Mac so I can't compare it to the Mountain Lion version.

  • /usr/bin/ssh -V prints OpenSSH_5.9p1, OpenSSL 0.9.8r 8 Feb 2011 on my 10.8.0 VM. – Lri Oct 23 '13 at 11:07
  • Interessting, If you have time can you check what does "ssh-keygen -vvv -y -f id_rsa" show if you use a pkcs#8 key? – tripplet Oct 24 '13 at 10:29
  • My pkcs #8 key, derived via that same link, shows this: gist.github.com/cbowns/7359383/raw/… – cbowns Nov 7 '13 at 18:20

Using brew openssl and openssh fixes the PCKS#8 issue on Mavericks.

brew update
brew install openssl
brew link openssl --force
brew install openssh

# confirm correct bins are being used
# both should be located in /usr/local/bin
which openssl
which openssh

# add key back to keychain
ssh-add ~/.ssh/id_rsa

I'm not sure if force linking openssl breaks anything on Mavricks. So far, I haven't noticed any issues.


I was able to fix this issue by simply doing the following:

cd ~/.ssh
mv known_hosts known_hosts.old

Now go and connect. When it asks the standard question to add the fingerprint type yes.

  • But don't forget to check the fingerprint! – zigg Oct 25 '13 at 23:18
  • 1
    This is a different problem from what I was asking. The known hosts file has nothing to do with the problem encountered here (decrypting of the private key) – GaretJax Oct 26 '13 at 17:46

Happened to get this problem. By trying to specify the cipher, I was able to get it work well.

On Linux, when you try to generate key pairs, use this:

ssh-keygen -t rsa -Z aes256

The public key now with cipher aes256 can be correctly recognized by ssh on OSX (here, mine is 10.12.1).


You can convert a PuTTY key to an OpenSSL OS X key:

puttygen putty.ppk -O private-openssh -o osx.key

Type the passphrase and you're done.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .