{"record":{"id":"cf6b5972ae42a84f","repo":"kubernetes/kops","slug":"error-computing-key-fingerprint-for-ssh-key-v","errorCode":null,"errorMessage":"error computing key fingerprint for SSH key: %v","messagePattern":"error computing key fingerprint for SSH key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/sshkey.go","lineNumber":128,"sourceCode":"\t}\n\n\te.ID = actual.ID\n\tif e.IsExistingKey() && *e.Name != \"\" {\n\t\te.KeyFingerprint = actual.KeyFingerprint\n\t}\n\treturn actual, nil\n}\n\nfunc (e *SSHKey) Normalize(c *fi.CloudupContext) error {\n\tif e.KeyFingerprint == nil && e.PublicKey != nil {\n\t\tpublicKey, err := fi.ResourceAsString(e.PublicKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error reading SSH public key: %v\", err)\n\t\t}\n\n\t\tkeyFingerprint, err := pki.ComputeAWSKeyFingerprint(publicKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error computing key fingerprint for SSH key: %v\", err)\n\t\t}\n\t\tklog.V(2).Infof(\"Computed SSH key fingerprint as %q\", keyFingerprint)\n\t\te.KeyFingerprint = &keyFingerprint\n\t}\n\n\treturn nil\n}\n\nfunc (e *SSHKey) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (s *SSHKey) CheckChanges(a, e, changes *SSHKey) error {\n\tif a != nil {\n\t\tif changes.Name != nil {\n\t\t\treturn fi.CannotChangeField(\"Name\")\n\t\t}\n\t}","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/sshkey.go#L110-L146","documentation":"After reading the public key material, Normalize computes the AWS-style MD5 fingerprint via pki.ComputeAWSKeyFingerprint. Failure is wrapped as \"error computing key fingerprint for SSH key\". This indicates the key material is malformed or in an unsupported format.","triggerScenarios":"pki.ComputeAWSKeyFingerprint receives data that isn't a parseable SSH public key (e.g. a private key file, garbage bytes, or an unsupported format like a PEM-only blob).","commonSituations":"User passed a private key instead of a .pub file; key file contains Windows line endings with garbage; unsupported key algorithm/legacy format; truncated file.","solutions":["Pass the public key file (id_rsa.pub), not the private key.","Regenerate or re-export the key in OpenSSH format: ssh-keygen -y -f id_rsa > id_rsa.pub.","Check the file for corruption/CRLF issues and re-save.","Use a supported algorithm (rsa, ed25519) accepted by EC2 import."],"exampleFix":"// before\n--ssh-public-key=~/.ssh/id_rsa      # private key\n// after\n--ssh-public-key=~/.ssh/id_rsa.pub  # public key","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(pubKeyPath)\nif err != nil { return err }\nout, err := exec.Command(\"ssh-keygen\", \"-l\", \"-f\", pubKeyPath).Output()\nif err != nil {\n    return fmt.Errorf(\"key %s is not a valid public key: %v\", pubKeyPath, err)\n}","typeGuard":"func isPublicKeyMaterial(data []byte) bool {\n    return bytes.HasPrefix(data, []byte(\"ssh-rsa \")) ||\n        bytes.HasPrefix(data, []byte(\"ssh-ed25519 \")) ||\n        bytes.HasPrefix(data, []byte(\"ecdsa-sha2-\"))\n}","tryCatchPattern":null,"preventionTips":["Pass .pub files, never private keys.","Regenerate the public part with ssh-keygen -y -f id_rsa if only the private key exists.","Use key algorithms supported by EC2 (rsa, ed25519)."],"tags":["ssh","fingerprint","key-format","validation"],"backgroundTag":"invalid-ssh-key-format","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}