Skip to main content
Chariot v2.0.0 - v2.6.0

How to Identify My Private Key Type

What a Private Key Means in Chariot​

In Chariot, a private key is a cryptographic key used for TLS/SSL certificate-based authentication in MQTT communication.

This is different from an SSH private key:

  • SSH keys → used for remote access (e.g., logging into a VM)
  • TLS private keys → used to secure communication and verify identity between systems

Private keys in Chariot are part of a certificate-based trust model that enables secure, encrypted data transfer.

A private key has both a type (e.g., RSA or ECDSA) and a format (e.g., PKCS#1 or PKCS#8). Chariot’s requirements apply to the format, not just the type.

Private Key Requirements in Chariot​

Your private key must:

  • Be in PEM format
  • Be one of:
    • PKCS#1 (RSA) ✅
    • PKCS#8 (unencrypted) ✅ (supported in 2.3.1+)
  • Encrypted private keys are not supported ❌

How to Identify Your Private Key​

Open your private key file and check the header:

PKCS#1 (RSA)

-----BEGIN RSA PRIVATE KEY-----

PKCS#8 (unencrypted)

-----BEGIN PRIVATE KEY-----

PKCS#8 (encrypted — NOT supported)

-----BEGIN ENCRYPTED PRIVATE KEY-----

Identify Using OpenSSL (Optional)​

Run one of the following commands:

  • openssl pkey -in your-key.pem -text -noout
  • openssl rsa -in your-key.pem -check

Look for:

  • RSA Private-Key → RSA
  • EC Private-Key → ECDSA

Convert PKCS#8 to PKCS#1 (If Needed)​

If your key is in PKCS#8 format and needs to be converted --> openssl rsa -in input.pem -out output.pem

For OpenSSL 3+: --> openssl rsa -in input.pem -traditional -out output.pem

Common Private Key Types

  • RSA — most widely used and broadly supported
  • ECDSA — more efficient, but not supported in all environments

Common File Formats

  • .pem → Base64-encoded format (most common)
  • .key → generic private key file
  • PKCS#1 → traditional RSA format
  • PKCS#8 → newer, more flexible format

⚠️ Important Notes

  • Never share private keys
  • Restrict file permissions (e.g., chmod 400)
  • If a private key is lost, certificates must be regenerated