, as they show, and then use that key in OpenSSH. To create the cert for the public key of this keypair, use the private key file (in either traditional or pkcs8), in a slight modification of the command GCP shows: openssl req -x509 -new -key private_file -days 365 -out public_key.pem -subj '/CN=unused'īut if you want to use the same key for SSH and GCP, it's easier to go the other direction - generate the keypair and cert with openssl req -newkey -keyout -nodes. Openssl pkcs8 -topk8 -nocrypt -in private_trad -out private_pkcs8 If it does, use: openssl pkey -in private_trad -out private_pkcs8 It's not clear to me if GCP wants specifically PKCS8 unencrypted (clear) format for the privatekey rather than OpenSSL's 'traditional' format the examples all are PKCS8. # same value for old and new, but it re-writes the file in 'old' format # you don't need to actually _change_ the password, you can enter PEM-like labels BEGIN/END OPENSSH PRIVATE KEY) you can convert it to 'old' format by using the change-password function: ssh-keygen -p -m pem If you already have a file generated in OpenSSH 'new' format (i.e. In lower versions omit -m pem OpenSSH already uses 'old' format. In OpenSSH 7.8 up, to generate RSA keypair in OpenSSH's 'old' format, which is (exactly) the same as OpenSSL's 'traditional' or 'legacy' format: ssh-keygen -t rsa -m pem The method they show is almost usable except that you want to generate the key in OpenSSH instead of OpenSSL - although I don't know why, see below. Assuming you are talking about this yes it apparently wants an RSA key, not ed25519, and it wants an X.509 cert which can be self-signed containing the key, which is not 'converting' the key because the information in the cert is different from the information in the key, even though they confusingly and misleadingly describe it as being the public key.

Ssh keygen ed25519