Load key "/path/to/key": error in libcrypto

The path is the key file you used. Some damage produces 'Load key "…": invalid format' instead (for PEM keys with a missing middle line, for example); the causes overlap.

OpenSSH (ssh, ssh-add, ssh-keygen, git over SSH) — key file could not be parsed

What it means

OpenSSH could not parse the private key file in its own format and then handed it to OpenSSL (libcrypto) as a PEM key, which failed too — so the reported error is the generic "error in libcrypto", not a precise reason. In current OpenSSH (checked on 10.0) almost any damage to an `OPENSSH PRIVATE KEY` file ends here: Windows line endings, a missing final newline, a lost line, or a key flattened onto one line. Damaged PEM/PKCS#8 keys land here when truncated or flattened, and PuTTY `.ppk` files too.

Why it happens

• Windows line endings (CRLF)

  common

  Keys pasted into CI secret fields, edited on Windows, or checked out with `core.autocrlf` get `\r\n` line endings. OpenSSH-format keys then fail to parse.

• The final newline was trimmed

  common

  Many secret stores and `echo -n`/`$(...)` constructions drop the trailing newline. For OpenSSH-format keys this alone breaks loading.

• Lines lost, truncated or joined

  common

  Environment variables that collapse newlines into spaces, copy-paste from chat, or size limits that cut the key.

• Not an OpenSSH or PEM key

  occasional

  PuTTY `.ppk` files, public keys, certificates or JWKs given as identity files are not private keys OpenSSH can read.

How to fix it

1. 1.

   Write CI keys byte-exact

   Strip `\r`, end with a newline, set mode 600, and test with `ssh-keygen -y` right away so a broken secret fails the setup step clearly.

   # CI: write the key exactly, normalise line endings, guarantee the final newline, restrict permissions
   install -d -m 700 ~/.ssh
   printf '%s\n' "$SSH_PRIVATE_KEY" | tr -d '\r' > ~/.ssh/id_ed25519
   chmod 600 ~/.ssh/id_ed25519
   ssh-keygen -y -f ~/.ssh/id_ed25519 > /dev/null && echo "key parses"

2. 2.

   Look at the file's framing

   `file`, the first line and the last bytes show CRLF endings, a missing newline or a one-line key immediately.

   file ~/.ssh/id_ed25519                  # "OpenSSH private key" vs "with CRLF line terminators"
   head -1 ~/.ssh/id_ed25519; tail -c 40 ~/.ssh/id_ed25519 | od -c | tail -3   # framing and final "\n"
   wc -l ~/.ssh/id_ed25519                 # a one-line file means the newlines were lost

← Browse the full signature error database