# GCE service account: "RSA key format is not supported" **URL:** \ **Category:** Ansible Project\ **Created:** [June 5, 2014, 4:13pm UTC](https://forum.ansible.com/t/gce-service-account-rsa-key-format-is-not-supported/15412 "2014-06-05T16:13:26Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Michael\_Lucas](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Michael\_Lucas](https://forum.ansible.com/u/Michael_Lucas)\ **Post date:** [June 5, 2014, 4:13pm UTC](https://forum.ansible.com/t/gce-service-account-rsa-key-format-is-not-supported/15412/1 "2014-06-05T16:13:26Z")
Hi, I'm running $ ansible --version ansible 1.7 (devel 74f20ebf79) last updated 2014/06/04 11:36:10 (GMT -400) on a week-old OpenBSD snapshot. I'm trying to get Google Compute Engine running with a service account, following instructions from: [http://docs.ansible.com/guide\_gce.html](http://docs.ansible.com/guide_gce.html) I have one test instance up, just so Ansible can see it. When I run gce.py, I get: $ ./gce.py --list Traceback (most recent call last):   File "./gce.py", line 257, in \     GceInventory()   File "./gce.py", line 101, in \_\_init\_\_     self.driver = self.get\_gce\_driver()   File "./gce.py", line 157, in get\_gce\_driver     gce = get\_driver(Provider.GCE)(\*args, \*\*kwargs)   File "/usr/local/lib/python2.7/site-packages/libcloud/compute/drivers/gce.py", line 536, in \_\_init\_\_     super(GCENodeDriver, self).\_\_init\_\_(user\_id, key, \*\*kwargs)   File "/usr/local/lib/python2.7/site-packages/libcloud/compute/base.py", line 636, in \_\_init\_\_     api\_version=api\_version, \*\*kwargs)   File "/usr/local/lib/python2.7/site-packages/libcloud/common/base.py", line 950, in \_\_init\_\_     self.connection = self.connectionCls(\*args, \*\*conn\_kwargs)   File "/usr/local/lib/python2.7/site-packages/libcloud/compute/drivers/gce.py", line 75, in \_\_init\_\_     \*\*kwargs)   File "/usr/local/lib/python2.7/site-packages/libcloud/common/google.py", line 523, in \_\_init\_\_     self.token\_info = self.auth\_conn.get\_new\_token()   File "/usr/local/lib/python2.7/site-packages/libcloud/common/google.py", line 438, in get\_new\_token     key = RSA.importKey(self.key)   File "/usr/local/lib/python2.7/site-packages/Crypto/PublicKey/RSA.py", line 682, in importKey     raise ValueError("RSA key format is not supported") ValueError: RSA key format is not supported Any idea why? My config files follow (I've made minor changes to obfuscate actual project numbers and such, but the number of characters all stays the same): My gce.ini is: $ grep -v ^# gce.ini [gce] libcloud\_secrets = /etc/ansible/secrets.py secrets.py is: GCE\_PARAMS = ('764898231355-irjfbhu4jv3ihrnh1klar9egfiib2t4d@developer.gserviceaccount.com', '/home/ansible/gce-cert.pem') GCE\_KEYWORD\_PARAMS = {'project': 'vast-service-302'} I created the PEM file with: $ openssl.exe pkcs12 -in 4f5c41f18ceeed58b36e4cd77c7c40ce8fee55c6-privatekey.p12 -nodes -nocerts | openssl rsa -out gce-key3.pem Enter Import Password: MAC verified OK writing RSA key $ And the file gce-cert.pem contains: -----BEGIN RSA PRIVATE KEY----- MIICWwIBAAKBgQC3hj9hSQjC211qbEK6yMepjeIv53DF0OdkJI1TynH5UN0er4BN 7jnOaGf/BWrwIIKFbLrbSF9XlDjJ4PA+PLzQCmSGRwI4+OOZ/1TRyom+Wpv9owRl ... rmc86L3+SpMdc4ZfmwJAM60M4jCeKh+ZEWqUvhTVFvaOM1VXVAEJCIs5nvIL8Vao nzSQW7YBrjlG7/o0AaTJEJaVN8KXQgkS0etKUFOHnA== -----END RSA PRIVATE KEY----- Having read the archives on this error message: I'm pretty confident that this is an actual RSA key, as file(1) recognizes it as such. The OpenBSD box has py-libcloud-0.14.1. The Ansible host can talk to Google Cloud -- I can run gcutil as ansible, with it logged in using my Google account. But I'd really rather use the service account for this. Any suggestions? ==ml ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [June 6, 2014, 12:39pm UTC](https://forum.ansible.com/t/gce-service-account-rsa-key-format-is-not-supported/15412/2 "2014-06-06T12:39:07Z")
I don’t know about this one, maybe some of the GCE folks involved with the module can chime in. A traceback is very much a bug, so please make sure one is filed and we can get Eric Johnsons’s attention on it on GitHub. ---
**Author:** ![Eric\_Johnson](https://avatars.discourse-cdn.com/v4/letter/e/ed655f/32.png) [@Eric\_Johnson](https://forum.ansible.com/u/Eric_Johnson)\ **Post date:** [June 6, 2014, 5:06pm UTC](https://forum.ansible.com/t/gce-service-account-rsa-key-format-is-not-supported/15412/3 "2014-06-06T17:06:31Z")
Hi Michael (Lucas), First, I’d suggest deleting that service account and creating new one since I believe you’ve shared a bit too much information. 🙂 As for the traceback, I’m not sure what you’re getting that error. It looks like you’ve done everything to get set up just fine. I’ve never tried this on a FreeBSD system, so I’ll see if I can fire up an instance with that and see if I can replicate. I’ll follow up by Monday. But do whack those credentials straight away! Eric ---
**Author:** ![Michael\_Lucas](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@Michael\_Lucas](https://forum.ansible.com/u/Michael_Lucas)\ **Post date:** [June 19, 2014, 5:24pm UTC](https://forum.ansible.com/t/gce-service-account-rsa-key-format-is-not-supported/15412/4 "2014-06-19T17:24:23Z")
I should have mentioned, those credentials were changed for just that reason… altered many characters to obscure them, but left them the exact same length and format. Just updated Ansible and tried again, same result. Issue #7845 filed.