SSH keys function in FileZilla but fail in PuTTY after a Raspberry Pi upgrade to Bullseye because the two clients interpret OpenSSH-formatted private keys differently. FileZilla uses libssh, which natively supports the modern OpenSSH key format, whereas PuTTY requires conversion to its proprietary PPK format via PuTTYgen. This incompatibility often surfaces during OS upgrades where default SSH configurations or key generation methods change, leading to authentication errors specifically within the Windows-based PuTTY client while SFTP tools continue to work seamlessly.
Understanding the Key Format Discrepancy
The core issue lies in how SSH keys are stored and interpreted. When you generate an SSH key pair on a Linux system (like your Raspberry Pi) using standard tools like
ssh-keygen, the private key is saved in the OpenSSH format by default. This format typically begins with
-----BEGIN OPENSSH PRIVATE KEY-----.
FileZilla, particularly versions running on Windows, utilizes the
libssh library for its SFTP functionality. The
libssh library is designed to be highly compatible with standard OpenSSH implementations, meaning it can read and use these modern key files directly without any additional steps. This is why your connection works perfectly when configuring the Site Manager in FileZilla under the "Logon Type" set to "Key file".
PuTTY, however, operates on a different architecture. It does not use
libssh as its primary engine for key handling in the same way. Instead, PuTTY expects private keys to be in its own proprietary
.ppk (PuTTY Private Key) format. If you point PuTTY’s Pageant agent or the Connection > SSH > Auth settings to a raw OpenSSH-format key file, PuTTY will often reject it silently or throw an error such as "Unable to open key file" or "Invalid key format." This discrepancy becomes more apparent after a Raspberry Pi OS upgrade to Bullseye, as newer versions of OpenSSH may enforce stricter security defaults or change the default key storage locations, making the format mismatch more obvious if users haven't previously converted their keys.
Converting Your Key for PuTTY Compatibility
To resolve this, you must convert your existing OpenSSH private key into a PuTTY-compatible
.ppk file. You do not need to generate a new key pair on the Raspberry Pi; you only need to transform the existing private key that already works with FileZilla.
You will need the
puttygen.exe utility, which is included in the standard PuTTY installation package. Follow these steps:
- Launch PuTTYgen: Open the Start menu and search for "PuTTYgen" or navigate to the directory where you installed PuTTY.
- Load the Existing Key: In the PuTTYgen window, click the Load button. By default, PuTTYgen might not show OpenSSH key files. Change the file type dropdown at the bottom from "PuTTY SSH-2 Keys" to "All Files" or "OpenSSH Private-Key Files".
- Select the Key File: Browse to the location of your Raspberry Pi private key (usually found in
C:\Users\\.ssh\id_rsa or wherever you copied it from the Pi). Select the file and click Open.
- Save the New Key: Once loaded, PuTTYgen will parse the key and display the key fingerprint. Click Save private key. You will likely receive a warning about saving the key in unencrypted format; confirm this unless you wish to add a passphrase. Save the file with a
.ppk extension (e.g., rpi_bullseye.ppk).
This new
.ppk file is now compatible with PuTTY. You can discard the old method of trying to load the raw key file into PuTTY.
Configuring PuTTY to Use the Converted Key
With the
.ppk file created, you need to ensure PuTTY uses it for authentication. Unlike FileZilla, which stores the key path in the site profile, PuTTY handles keys through the Pageant agent or direct session settings.
Option A: Using Session Settings (Recommended for Single Connections)
1. Open PuTTY and enter your Raspberry Pi's IP address in the "Host Name" field.
2. Navigate to
Connection >
SSH >
Auth in the left-hand category tree.
3. Under "Private key file for authentication," click
Browse and select your newly created
.ppk file.
4. Return to the
Session category and save this configuration with a name (e.g., "Raspberry Pi Bullseye") so you don't have to reconfigure it every time.
Option B: Using Pageant (For Multiple Sessions)
If you frequently connect to multiple servers, loading the key into Pageant is more efficient.
1. Ensure Pageant is running (it usually runs in the system tray).
2. Right-click the Pageant icon in the taskbar and select
Add Key.
3. Select your
.ppk file.
4. Now, any PuTTY session configured to use SSH authentication will automatically try the key loaded in Pageant. You still need to ensure the correct username is specified in the Session settings under
Connection >
Data.
Raspberry Pi Bullseye Specific Considerations
The upgrade to Raspberry Pi OS Bullseye introduced changes to the SSH server configuration (
/etc/ssh/sshd_config). While most default settings remain backward compatible, it is worth verifying that public key authentication is enabled.
Check the following lines in your
sshd_config file on the Raspberry Pi:
PubkeyAuthentication yesAuthorizedKeysFile .ssh/authorized_keys
Ensure that
PubkeyAuthentication is set to
yes. Also, verify that the permissions on the
.ssh directory and the
authorized_keys file are correct. The
.ssh directory should be
700 (drwx------), and the
authorized_keys file should be
600 (-rw-------). Incorrect permissions are a common cause of SSH key failures, especially after an OS upgrade where file ownership or permissions might have been reset or migrated incorrectly.
If you recently moved your user account or home directory structure, ensure that the
authorized_keys file contains the corresponding public key from your original key pair. You can verify the public key content by running
cat ~/.ssh/id_rsa.pub on the Pi and comparing it to the key shown in PuTTYgen.
For further assistance with related SSH configuration issues, you may find the following resources helpful:
Raspberry Pi 5: Can't SSH as a PIServer via Public Key from Windows 10 discusses similar public key rejection scenarios on newer hardware. Additionally,
Can't connect to SSH on a Raspberry PI provides broader troubleshooting steps for connectivity issues that may overlap with permission problems.
Frequently Asked Questions
Why did my SSH keys stop working after the Bullseye upgrade?
The upgrade likely changed default SSH configurations or key formats, exposing the incompatibility between PuTTY's expected PPK format and the standard OpenSSH format. FileZilla continued to work because its underlying library supports OpenSSH keys natively, masking the issue until you tried using PuTTY.
Can I use the same key file for both FileZilla and PuTTY without converting?
No, PuTTY cannot directly read OpenSSH-format private keys. You must convert the key using PuTTYgen to create a
.ppk file. However, you can keep the original OpenSSH key for FileZilla and Linux command-line access, using the converted version only for Windows/PuTTY workflows.
Is it safe to save the converted PPK file without a passphrase?
It is less secure than using a passphrase, but it is a common practice for automated scripts or convenience. If security is a concern, add a passphrase during the "Save private key" step in PuTTYgen. Note that if you add a passphrase, Pageant will prompt you for it upon startup, or you must specify it in PuTTY's Auth settings depending on your setup.
What if PuTTYgen fails to load my key file?
Ensure you changed the file type filter in PuTTYgen from "PuTTY SSH-2 Keys" to "All Files" or "OpenSSH Private-Key Files." If it still fails, the key file might be corrupted or encrypted in a way PuTTYgen doesn't support. Try copying the key content to a new file and ensuring there are no extra characters or line breaks at the end of the file.
How do I check if my authorized_keys file is correct?
Run
cat ~/.ssh/authorized_keys on the Raspberry Pi. The content should match the public key generated alongside your private key (usually ending in
.pub). Ensure the file permissions are exactly
600 and the parent
.ssh directory is
700 using
chmod.