kubernetes/kops · error

error computing fingerprint for SSH public key: %v

Error message

error computing fingerprint for SSH public key: %v

What it means

ComputeAWSKeyFingerprint only supports RSA (MD5 of the DER-encoded PKIX public key, AWS-style) and ed25519 (SHA256 fingerprint). When rsaToDER fails to convert/normalize the parsed SSH key into an *rsa.PublicKey it wraps the cause with this message.

Source

Thrown at pkg/pki/sshkey.go:80

		}
		colonSeparated.WriteByte(sshKeyFingerprint[i])
	}

	return colonSeparated.String()
}

// ComputeAWSKeyFingerprint computes the AWS-specific fingerprint of the SSH public key
func ComputeAWSKeyFingerprint(publicKey string) (string, error) {
	sshPublicKey, err := parseSSHPublicKey(publicKey)
	if err != nil {
		return "", err
	}

	switch sshPublicKey.Type() {
	case ssh.KeyAlgoRSA:
		der, err := rsaToDER(sshPublicKey)
		if err != nil {
			return "", fmt.Errorf("error computing fingerprint for SSH public key: %v", err)
		}
		h := md5.Sum(der)
		return colonSeparatedHex(h[:]), nil
	case ssh.KeyAlgoED25519:
		return ssh.FingerprintSHA256(sshPublicKey), nil
	}

	return "", fmt.Errorf("unexpected type of SSH key (%T); AWS can only import RSA and ed25519 keys", sshPublicKey)
}

// ComputeOpenSSHKeyFingerprint computes the OpenSSH fingerprint of the SSH public key
func ComputeOpenSSHKeyFingerprint(publicKey string) (string, error) {
	sshPublicKey, err := parseSSHPublicKey(publicKey)
	if err != nil {
		return "", err
	}

	h := md5.Sum(sshPublicKey.Marshal())

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the key is a genuine RSA public key: `ssh-keygen -l -f id_rsa.pub` should report RSA size
2. Regenerate the key pair if the blob is corrupted
3. If you don't need AWS MD5 fingerprints, use ed25519 keys, which take the FingerprintSHA256 path

func keyTypeIsRSA(pubKey string) bool {
	f := strings.Fields(pubKey)
	return len(f) > 0 && f[0] == "ssh-rsa"
}
if keyTypeIsRSA(pubKey) {
	if _, err := pki.ComputeAWSKeyFingerprint(pubKey); err != nil {
		return fmt.Errorf("RSA key unusable for AWS fingerprint: %w", err)
	}
}

fp, err := pki.ComputeAWSKeyFingerprint(pubKey)
if err != nil {
	if strings.Contains(err.Error(), "error computing fingerprint") {
		// fall back to SHA256 fingerprint of raw key
		fp = genPublicKeyFingerprint(publicKey)
		return fp, nil
	}
	return "", err
}

When it happens

Trigger: An RSA SSH key whose underlying public key cannot be type-asserted/converted to rsa.PublicKey inside rsaToDER — e.g. an unexpected crypto.PublicKey concrete type returned by ssh.ParsePublicKey for a key typed 'ssh-rsa'.

Common situations: Rare; usually hit with hand-crafted or corrupted key blobs claiming ssh-rsa type but carrying non-RSA key material, or exotic key encodings.

Related errors

• unexpected type of SSH key (%T); AWS can only import RSA and
• error marshaling SSH public key: %v
• error building ssh key: %v
• error fingerprinting SSH public key: %v
• error computing key fingerprint for SSH key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b0ff1749a36218fe. Report an issue: GitHub.