kubernetes/kops · error

error marshaling SSH public key: %v

Error message

error marshaling SSH public key: %v

What it means

rsaToDER converts the parsed SSH RSA key to an *rsa.PublicKey and then serializes it with x509.MarshalPKIXPublicKey to produce DER bytes for the MD5 fingerprint. Failure here means Go's x509 marshaller refused the key (nil or invalid key parameters).

Source

Thrown at pkg/pki/sshkey.go:114

	}

	h := md5.Sum(sshPublicKey.Marshal())
	return colonSeparatedHex(h[:]), nil
}

// rsaToDER gets the DER encoding of the SSH public key
// Annoyingly, the ssh code wraps the actual crypto keys, so we have to use reflection tricks
func rsaToDER(pubkey ssh.PublicKey) ([]byte, error) {
	var cryptoKey crypto.PublicKey
	var rsaPublicKey *rsa.PublicKey

	pubkeyValue := reflect.ValueOf(pubkey)
	targetType := reflect.ValueOf(rsaPublicKey).Type()
	rsaPublicKey = pubkeyValue.Convert(targetType).Interface().(*rsa.PublicKey)
	cryptoKey = rsaPublicKey
	der, err := x509.MarshalPKIXPublicKey(cryptoKey)
	if err != nil {
		return nil, fmt.Errorf("error marshaling SSH public key: %v", err)
	}
	return der, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the RSA key pair with ssh-keygen and re-import
2. Verify the key parses with `openssl rsa -pubin -in pub.key -text -noout` equivalents
3. Update Go/kOps if the key uses a rarely exercised size that trips an x509 edge case

fp, err := pki.ComputeAWSKeyFingerprint(pubKey)
if err != nil {
	if strings.Contains(err.Error(), "error marshaling SSH public key") {
		return "", fmt.Errorf("key material invalid; regenerate key pair: %w", err)
	}
	return "", err
}

When it happens

Trigger: MarshalPKIXPublicKey returning an error for the converted rsa.PublicKey — practically only when the key structure is invalid (zero modulus/exponent) or a Go/x509 limitation.

Common situations: Corrupted key blobs whose decoded numbers fail x509 validation; extremely rare with keys produced by ssh-keygen.

Related errors

• error computing fingerprint for SSH public key: %v
• unexpected type of SSH key (%T); AWS can only import RSA and
• error fingerprinting SSH public key: %v
• error computing key fingerprint for SSH key: %v
• error computing key fingerprint for SSH key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cc2778fb258b875f. Report an issue: GitHub.