Unable to Connect Linux EC2 Instance via Putty (OpenSSH) on Windows Machine

You cannot connect a Linux EC2 instance via PuTTY because Windows uses OpenSSH keys while PuTTY requires the proprietary PPK format. You must convert your .pem private key using PuTTYgen, save it as a .ppk file, and then load that specific file into the SSH agent settings within PuTTY to establish a successful connection.

Understanding the Key Format Incompatibility

When you launch an Amazon EC2 instance running Linux, AWS provides a default key pair consisting of a public key and a private key. By design, the private key is stored in Privacy-Enhanced Mail (PEM) format with a .pem extension. This format is native to the OpenSSH protocol, which is the standard SSH implementation on Linux and macOS systems. However, the popular Windows client PuTTY does not support the PEM format directly. Instead, PuTTY relies on its own proprietary key format known as PuTTY Private Key (PPK). This fundamental difference in encryption standards and file structures is the primary reason why attempting to load a .pem file directly into PuTTY fails. The software will either refuse to open the file or report that the key is invalid. To bridge this gap, you must perform a one-time conversion of your existing AWS key pair into the PPK format. This process does not alter the security of your key; it merely repackages the cryptographic data so that PuTTY can interpret it correctly. It is crucial to understand that you are converting the private key, not the public key, which remains unchanged on the server side.

Locating Your Existing Private Key

Before you can begin the conversion, you need to locate the original private key file downloaded from the AWS Management Console. If you created the instance recently, this file should still be in your downloads folder or wherever you saved it during the instance launch wizard. If you have lost the original .pem file, you cannot recover it. In such cases, you must create a new key pair in the AWS console and associate it with your running instance, which involves stopping the instance, detaching the old key, and attaching the new one. Assuming you still possess the original file, note its location on your Windows hard drive, as you will need to browse to it in the next step.

Converting the Key Using PuTTYgen

The tool responsible for this translation is called PuTTYgen, which is installed alongside PuTTY when you set up the suite on Windows. Launch PuTTYgen from your Start menu. Once the application opens, you will see a clean interface with a progress bar at the top and various configuration options below. Click the "Load" button located in the bottom left corner. A file browser dialog will appear. By default, this dialog may only show files with the .ppk extension. You must change this filter by selecting "All Files (*.*)" from the dropdown menu near the bottom of the window. This allows you to see and select your .pem file. Navigate to the location of your AWS private key and select it. Click "Open". PuTTYgen will analyze the file and display a message indicating that it has successfully loaded the key. At this stage, you might be prompted to enter a passphrase if your original key was encrypted. If you did not set a passphrase during creation, simply leave the fields blank and proceed. The interface will now show details about the key type, typically RSA, and the key bits, usually 2048 or 4096. You should verify that the fingerprint matches what you expect, although this is optional for basic connectivity.

Saving the New PPK File

Once the key is loaded and verified, you must save it in the correct format. Look for the "Save private key" button in the center of the PuTTYgen window. Clicking this will prompt you to choose a save location. Name the file something recognizable, such as my-ec2-key.ppk, and ensure it is saved with the .ppk extension. Store this file in a secure directory on your Windows machine. Do not share this file publicly, as anyone with access to it can connect to your EC2 instance. After saving, you can close PuTTYgen. You now have a key file that PuTTY understands natively.

Configuring PuTTY for Connection

With the converted key ready, open the main PuTTY application. In the "Session" category on the left sidebar, enter the Public DNS name or the Public IP address of your EC2 instance in the "Host Name (or IP address)" field. Ensure the connection type is set to "SSH" and the port is 22. Before clicking "Open," you must configure the authentication method. Navigate to the "Connection" section in the left tree menu, expand it, and select "SSH". Under the SSH submenu, click on "Auth". In the "Private key file for authentication" field, click the "Browse" button. Locate and select the .ppk file you just saved using PuTTYgen. Once selected, the path will appear in the text box. Return to the "Session" category at the top of the tree menu. You can optionally give your session a name in the "Saved Sessions" box and click "Save" to avoid re-entering these details later. Finally, click the "Open" button. A security alert may appear regarding the host key fingerprint; accept it to proceed. If the key conversion was successful and the credentials are correct, you will be logged into your Linux instance.

Troubleshooting Common Issues

If you encounter connection failures after following these steps, check several common pitfalls. First, verify that the security group attached to your EC2 instance allows inbound traffic on port 22 from your current IP address. If the security group blocks SSH, no amount of key conversion will help. Second, ensure you are using the correct username for the Linux distribution. Ubuntu instances use ubuntu, Amazon Linux uses ec2-user, and CentOS often uses centos or root. Third, confirm that the .ppk file corresponds exactly to the key pair associated with the instance in the AWS console. Mismatched keys are a frequent source of "Permission Denied" errors. For similar connectivity issues involving different virtual environments, you might find Connection Refused PuTTY to VMWare Workstation Guest Rocky Linux helpful for diagnosing network-level blockages.

Frequently Asked Questions

Can I use the built-in Windows OpenSSH client instead of PuTTY?

Yes, Windows 10 and 11 include a native OpenSSH client that supports .pem files directly. You can connect via Command Prompt or PowerShell using the command ssh -i C:\path\to\key.pem username@ip-address. This eliminates the need for PuTTYgen entirely if you prefer command-line tools over a graphical interface.

What should I do if I forget the passphrase for my PPK key?

If you set a passphrase during the conversion in PuTTYgen and forget it, there is no way to recover it. You must delete the corrupted .ppk file, convert the original .pem key again without setting a passphrase, and save the new version. Always remember passphrases securely, as they add a layer of protection against unauthorized access.

Why does PuTTY say "Server refused our key"?

This error indicates that the private key you provided does not match the public key authorized on the EC2 instance. Verify that you uploaded the correct .ppk file derived from the right .pem key. Additionally, ensure that the key pair is actually associated with the running instance in the AWS EC2 dashboard.

Is it safe to store the .ppk file on my computer?

Yes, storing the .ppk file locally is standard practice, but you must protect it like any other sensitive credential. Restrict file permissions so that only your user account can read it. Avoid storing it in shared network drives or unencrypted cloud folders, as possession of this file grants full SSH access to your server.

How do I update the key if I generate a new one in AWS?

If you create a new key pair in AWS, you must repeat the conversion process with the new .pem file to generate a new .ppk. Update your PuTTY session configuration to point to this new file. Remember that changing the key pair in AWS also requires updating the instance's metadata to recognize the new public key.