"not a valid OPENSSH private key file" — building a compat layer for seven SSH private-key formats

Short summary

Need to parse multiple SSH private-key formats in production code? Paramiko only handles OpenSSH and PKCS#1, but real-world hosting providers generate seven different formats including PKCS#8, EC, and PuTTY .ppk. We built a compat layer that detects incoming formats and normalizes them to OpenSSH before paramiko processes them, including a hand-rolled parser for PuTTY v2/v3 keys. Error messages were redesigned to show what format arrived, what's accepted, and the recommended fix—a pattern that cuts support tickets.

• •Paramiko's SSH key parser is limited to OpenSSH and PKCS#1, rejecting PKCS#8 and PuTTY formats from real hosting providers
• •A detect-and-normalize compat layer transparently converts seven formats to OpenSSH before handing off to paramiko
• •Error messages redesigned to show format received, accepted formats, and recommended next steps—reducing support burden

Generated with AI, which can make mistakes.