Key Files & Formats

A partner sends partner.pem and asks you to install it in Files.com. The filename does not tell you whether it is a public certificate, a private key, or several blocks packaged together. First identify the key's job and correct destination, then check whether the file contains the public or private material that destination needs.

The algorithm describes the cryptographic key, while the format describes how software stores or exchanges it. A format conversion preserves the key, so it can make an existing identity usable by different software. Generating a replacement creates a different identity and requires a separate trust change.

Recognizing Public and Private Material

Text formats include recognizable opening lines. These examples identify formats only; they are not usable keys.

DER is a binary encoding used for certificates and keys. A .cer or .crt file can contain a DER certificate or a PEM certificate. Renaming it changes neither encoding nor contents. Open the file with the corresponding key or certificate tool when a text header is absent.

Formats for Each Job

Recognizing the contents tells you what kind of material you have, but its owner still needs to identify the intended account, server, or recipient. An OpenSSH public key can serve as a client's login key or a server's host key, just as a public X.509 certificate can identify a TLS endpoint or an AS2 message identity. In Files.com, that purpose determines whether an SSH public key belongs under a user's SFTP Keys or in a Remote Server's Server Host Key setting.

Agree on file encryption independently of the connection method. A PGP requirement can call for an exchange of public keys even when Files.com manages the connection's service identities.

SSH keys, OpenPGP keys, and X.509 certificates are different objects. A tool converting an SSH key from PPK to OpenSSH does not turn it into a PGP key or a TLS certificate.

Choosing an SSH Key Algorithm

The client and server both need to support the algorithm you choose. A key generator may offer several choices while an older partner's transfer product or SSH library accepts only RSA, so confirm the requirements at both ends before generating the pair.

With OpenSSH, generate an Ed25519 pair with:

ssh-keygen -t ed25519 -f partner-sftp-key

For a partner requiring RSA, generate a 4096-bit pair with:

ssh-keygen -t rsa -b 4096 -f partner-sftp-rsa

Use a new filename for each pair. These commands prompt for a private-key passphrase and write the public key to the corresponding .pub file. Give the server operator the public file; configure the transfer client with the private key and its supported passphrase handling. OpenSSH's key-generation reference describes the type and size options.

When Files.com is the client, its SFTP Remote Server generator creates a 4096-bit RSA pair. For server identity, prefer the managed Files.com host keys; generating a new login key does not require replacing them.

For RSA, confirm signature compatibility: a public key beginning ssh-rsa can use modern SHA-2 signatures and does not require the older SHA-1 method. Choose PGP algorithms and AS2 certificate types separately, according to those exchange requirements.

SSH Format Conversion

Convert keys with local tools supplied by the software's publisher so private material stays in controlled storage. An online conversion form would require handing that material to another service. Keep a protected original and write the converted output to a new file, preserving the working credential if the conversion does not produce what the destination needs.

With OpenSSH installed, extract the public portion from an existing private key:

ssh-keygen -y -f client-key > client-key.pub

This leaves the private input unchanged and writes an OpenSSH public-key line to the output file, ready to share. If the private key is protected by a passphrase, the command prompts for it.

Convert an RFC 4716 public key to an OpenSSH public-key line:

ssh-keygen -i -m RFC4716 -f partner-ssh2.pub > partner-openssh.pub

Export an OpenSSH public key in RFC 4716 format:

ssh-keygen -e -m RFC4716 -f client-key.pub > client-ssh2.pub

For PPK, PuTTYgen loads the private-key file and exports an OpenSSH private key through its Conversions menu. Copy the Public key for pasting into OpenSSH authorized_keys file field when the other side needs only the public key. These are different exports; sending the PPK itself discloses the private material.

For a service requiring an RSA private key in traditional PEM format, convert a copy of the RSA key:

cp rsa-client-key rsa-client-key.pem
ssh-keygen -p -m PEM -f rsa-client-key.pem

The command prompts for the current passphrase and the passphrase to use on the converted file. Both the original and the .pem copy remain private. Copying or renaming alone would leave the format unchanged; ssh-keygen performs the conversion. This command applies to RSA keys, while Ed25519 private keys use OpenSSH format.

OpenSSH's key tool reference documents further conversions and their algorithm restrictions. Match the destination's documented requirements rather than assuming every key fits every container.

A successful SSH format conversion preserves the public-key fingerprint. Compare it before replacing the configured credential; a different fingerprint means there is more to investigate than a change in file format.

Certificate and OpenPGP Encodings

Convert a public X.509 certificate from DER to PEM with OpenSSL:

openssl x509 -inform DER -in partner.cer -out partner.pem

For the same certificate, this changes its representation while preserving its certificate fingerprint. The output remains a public certificate; issuer trust still depends on the receiving system's configuration.

GnuPG can export an imported OpenPGP public key as armored text:

gpg --armor --export FULL_PUBLIC_KEY_FINGERPRINT > recipient-public.asc

Replace the placeholder with the verified full fingerprint. This public export is different from a secret-key backup. PGP Encryption & Signatures explains armored messages and why .asc alone does not identify whether a file contains a key, encrypted content, or a signature.