# creating RSA key with openssh\_keypair

**URL:** <https://forum.ansible.com/t/creating-rsa-key-with-openssh-keypair/38838>\
**Category:** Ansible Project\
**Created:** [August 1, 2024, 1:17pm UTC](https://forum.ansible.com/t/creating-rsa-key-with-openssh-keypair/38838 "2024-08-01T13:17:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Veera](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/veera/32/4107_2.png) [@Veera](https://forum.ansible.com/u/Veera)\
**Post date:** [August 1, 2024, 1:17pm UTC](https://forum.ansible.com/t/creating-rsa-key-with-openssh-keypair/38838/1 "2024-08-01T13:17:07Z")

</div>

Hi,

When I try to create ssh keypairs with the module ansible.builtin.openssh\_keypair , a new key pair is generated as expected.

$ cat test\_key1.yml

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [August 1, 2024, 2:20pm UTC](https://forum.ansible.com/t/creating-rsa-key-with-openssh-keypair/38838/2 "2024-08-01T14:20:36Z")

</div>

Hi,

> However the public-key is showing the caption as ssh-rsa .. and the  
> private key is displaying the label as "-----BEGIN OPENSSH PRIVATE  
> KEY----- and -----END OPENSSH PRIVATE KEY-----"
> 
> I am looking to create an rsa key-pairs with 2048b , something we  
> used to create with the command ssh-keygen -t rsa -b 2048  
> The private key must begin with "-----BEGIN RSA PRIVATE KEY-----" and  
> ends with "-----END RSA PRIVATE KEY-----"

Could you please elaborate why it \*\*must\*\* start with "-----BEGIN RSA  
PRIVATE KEY-----"? Does your SSH version not accept "-----BEGIN OPENSSH  
PRIVATE KEY-----"?

In any case, I would suggest to look at the private\_key\_format option  
of the module.

All the best,  
Felix

---

<div class="post-metadata">

**Author:** ![Veera](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/veera/32/4107_2.png) [@Veera](https://forum.ansible.com/u/Veera)\
**Post date:** [August 1, 2024, 5:21pm UTC](https://forum.ansible.com/t/creating-rsa-key-with-openssh-keypair/38838/3 "2024-08-01T17:21:26Z")

</div>

Yes , We need a RSA format PEM key which is compatible with the application .  
Whenever a OPENSSH PRIVATE Key generated with the playbook is used for authentication , login to the application is working but its not functioning 100% as expected .  
When a RSA format PEM or id\_rsa key ( ssh-keygen -t rsa -b 2048) is used then login and functioning of the application is working fine. (vendor recommended RSA format SSH key)

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [August 2, 2024, 10:52pm UTC](https://forum.ansible.com/t/creating-rsa-key-with-openssh-keypair/38838/4 "2024-08-02T22:52:16Z")

</div>

In what way is it “not functioning 100% as expected”?

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [August 3, 2024, 7:39am UTC](https://forum.ansible.com/t/creating-rsa-key-with-openssh-keypair/38838/5 "2024-08-03T07:39:37Z")

</div>

Add the following parameters to your task:

backend: cryptography  
private\_key\_format: pkcs1

Looking at the [docs](https://docs.ansible.com/ansible/latest/collections/community/crypto/openssh_keypair_module.html), this means that your application depends on OpenSSH \< 7.8, because only those versions created PKCS1 private key files (the ones with “BEGIN RSA…”).  
See [https://superuser.com/questions/1720991/](https://superuser.com/questions/1720991/) for an interesting read on some historical background and rationale.  
After reading that you may want to ask questions to your vendor, for example why their application insists on a legacy, less secure format (although the latter only applies to encrypted keys, which you don’t seem to be generating).

If it is a key for ssh, then they might also be using specific fields from the ASN.1 structure. This is possible, but then it’s not just an ssh key anymore.

Dick