kubernetes/kops · error

unexpected type of SSH key (%T); AWS can only import RSA and

Error message

unexpected type of SSH key (%T); AWS can only import RSA and ed25519 keys

What it means

AWS key fingerprints in EC2 are MD5-based (RSA) or SHA256 (ed25519); other algorithms (e.g. ECDSA, DSA, or ssh certificates) are not supported, so ComputeAWSKeyFingerprint rejects the key by concrete Go type after parsing. The %T verb names the unsupported Go type.

Source

Thrown at pkg/pki/sshkey.go:88

func ComputeAWSKeyFingerprint(publicKey string) (string, error) {
	sshPublicKey, err := parseSSHPublicKey(publicKey)
	if err != nil {
		return "", err
	}

	switch sshPublicKey.Type() {
	case ssh.KeyAlgoRSA:
		der, err := rsaToDER(sshPublicKey)
		if err != nil {
			return "", fmt.Errorf("error computing fingerprint for SSH public key: %v", err)
		}
		h := md5.Sum(der)
		return colonSeparatedHex(h[:]), nil
	case ssh.KeyAlgoED25519:
		return ssh.FingerprintSHA256(sshPublicKey), nil
	}

	return "", fmt.Errorf("unexpected type of SSH key (%T); AWS can only import RSA and ed25519 keys", sshPublicKey)
}

// ComputeOpenSSHKeyFingerprint computes the OpenSSH fingerprint of the SSH public key
func ComputeOpenSSHKeyFingerprint(publicKey string) (string, error) {
	sshPublicKey, err := parseSSHPublicKey(publicKey)
	if err != nil {
		return "", err
	}

	h := md5.Sum(sshPublicKey.Marshal())
	return colonSeparatedHex(h[:]), nil
}

// rsaToDER gets the DER encoding of the SSH public key
// Annoyingly, the ssh code wraps the actual crypto keys, so we have to use reflection tricks
func rsaToDER(pubkey ssh.PublicKey) ([]byte, error) {
	var cryptoKey crypto.PublicKey
	var rsaPublicKey *rsa.PublicKey

View on GitHub (pinned to 4c8573c808)

Solutions

1. Generate or convert to an RSA or ed25519 key: `ssh-keygen -t ed25519` and re-import via `kops create secret sshpublickey`
2. Remove/replace the unsupported keypair entry in the keyset
3. If AWS import is not the goal, use ComputeOpenSSHKeyFingerprint, which handles all key types

Example fix

// before
ssh-keygen -t ecdsa -f ~/.ssh/id_ecdsa
// after
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
kops create secret sshpublickey admin -i ~/.ssh/id_ed25519.pub

func keyAlgorithmSupportedForAWS(pubKey string) bool {
	f := strings.Fields(pubKey)
	if len(f) == 0 {
		return false
	}
	return f[0] == "ssh-rsa" || f[0] == "ssh-ed25519"
}
if !keyAlgorithmSupportedForAWS(pubKey) {
	return fmt.Errorf("AWS fingerprinting requires RSA or ed25519 keys")
}
fp, err := pki.ComputeAWSKeyFingerprint(pubKey)

func isAWSCompatibleKey(token string) bool {
	return token == "ssh-rsa" || token == "ssh-ed25519"
}

fp, err := pki.ComputeAWSKeyFingerprint(pubKey)
if err != nil {
	if strings.Contains(err.Error(), "unexpected type of SSH key") {
		return "", fmt.Errorf("generate an RSA or ed25519 key for AWS: %w", err)
	}
	return "", err
}

When it happens

Trigger: Computing the AWS fingerprint for an ssh-ed25519 is fine, but ecdsa-sha2-nistp256/384/521, ssh-dss, or sk-ecdsa keys reach the default fall-through return.

Common situations: Users importing ECDSA keys generated by `ssh-keygen -t ecdsa` and running kops commands that fingerprint keypairs (kops get/delete keypair workflows, ImportKeyPair, secret normalization).

Related errors

• error computing fingerprint for SSH public key: %v
• error building ssh key: %v
• error marshaling SSH public key: %v
• error fingerprinting SSH public key: %v
• error computing key fingerprint for SSH key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c7c46580de4bdb43. Report an issue: GitHub.