# How to get openssl rsa private key out of private\_key.json

**URL:** <https://community.letsencrypt.org/t/how-to-get-openssl-rsa-private-key-out-of-private-key-json/75435>\
**Category:** Issuance Tech\
**Created:** [October 22, 2018, 4:15am UTC](https://community.letsencrypt.org/t/how-to-get-openssl-rsa-private-key-out-of-private-key-json/75435 "2018-10-22T04:15:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hoangnganvy1993](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hoangnganvy1993](https://community.letsencrypt.org/u/hoangnganvy1993)\
**Post date:** [October 22, 2018, 4:15am UTC](https://community.letsencrypt.org/t/how-to-get-openssl-rsa-private-key-out-of-private-key-json/75435/1 "2018-10-22T04:15:06Z")

</div>

How to get a `openssl genrsa` compatible key out of the `private_key.json` which the official letsencrypt client creates (i.e., for using in e.g. [https://github.com/diafygi/acme-tiny/](https://github.com/diafygi/acme-tiny/))?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [October 22, 2018, 4:24am UTC](https://community.letsencrypt.org/t/how-to-get-openssl-rsa-private-key-out-of-private-key-json/75435/2 "2018-10-22T04:24:04Z")

</div>

> **[diafygi/acme-tiny](https://github.com/diafygi/acme-tiny/#use-existing-lets-encrypt-key)**
>
> A tiny script to issue and renew TLS certs from Let's Encrypt - diafygi/acme-tiny

  
shows:

Use existing Let’s Encrypt key  
Alternatively you can convert your key, previously generated by the original Let’s Encrypt client.  
The private account key from the Let’s Encrypt client is saved in the JWK format. acme-tiny is using the PEM key format. To convert the key, you can use the tool conversion script by JonLundy:

Download the script  
wget -O - “[https://gist.githubusercontent.com/JonLundy/f25c99ee0770e19dc595/raw/6035c1c8938fae85810de6aad1ecf6e2db663e26/conv.py](https://gist.githubusercontent.com/JonLundy/f25c99ee0770e19dc595/raw/6035c1c8938fae85810de6aad1ecf6e2db663e26/conv.py)” \> conv.py

Copy your private key to your working directory  
cp /etc/letsencrypt/accounts/acme-v01.api.letsencrypt.org/directory//private\_key.json private\_key.json

Create a DER encoded private key  
openssl asn1parse -noout -out private\_key.der -genconf \<(python conv.py private\_key.json)

Convert to PEM  
openssl rsa -in private\_key.der -inform der \> account.key

* * *

Have you followed those steps?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [November 21, 2018, 4:24am UTC](https://community.letsencrypt.org/t/how-to-get-openssl-rsa-private-key-out-of-private-key-json/75435/3 "2018-11-21T04:24:06Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.