Error message
unable to load Public Key
OpenSSL 1.1.x wording; still the most-quoted form. OpenSSL 3.5+ prints e.g. "Could not find private key of Public Key from key.pem" (reproduced on 3.6) — same failure, new phrasing. Wording varies by version.
What it means
The openssl command tried to read a public key from the file you named and found nothing it recognizes as one. The file exists — its content is the problem: a different object type (certificate, private key, SSH key), the wrong encoding, or not a key at all.
Why it happens
The file is a certificate, not a raw key
common"-----BEGIN CERTIFICATE-----" is an X.509 certificate that contains a public key but is not one. Commands expecting a bare SPKI (-pubin) refuse it; the key must be extracted first.
An OpenSSH key where PEM is expected
commonOne-line "ecdsa-sha2-nistp256 AAAA... user@host" entries (authorized_keys format) are OpenSSH's own encoding, not PEM/DER. OpenSSL cannot read them without conversion.
Private key passed with -pubin
commonThe -pubin flag promises the input is a public key. Pointing it at "-----BEGIN PRIVATE KEY-----" breaks that promise — drop the flag or derive the public half first.
DER file read as PEM
occasionalBinary .der/.cer files need -inform der (or since OpenSSL 3, often auto-detect via -in with the right command). PEM parsing of binary data finds no BEGIN line and fails.
How to fix it
- 1.
Extract the key from a certificate
One command produces the SPKI public key PEM that -pubin commands expect.
bash openssl x509 -in cert.pem -pubkey -noout > pubkey.pem openssl pkey -pubin -in pubkey.pem -noout -text # now loads - 2.
Convert an OpenSSH key to PEM
ssh-keygen exports authorized_keys-format entries as PKCS#8 PEM.
bash ssh-keygen -f id_ecdsa.pub -e -m pkcs8 > pubkey.pem - 3.
Derive the public half from a private key
If the file is actually the private key, don't use -pubin — derive the public key.
bash openssl pkey -in private.pem -pubout -out pubkey.pem