In this blog, we'll learn how to generate an RSA SSH Key Pair (Public and Private Key) for authenticating with an SFTP server. We'll also see how to convert the generated private key into a .PPK file, which is commonly required by tools like WinSCP.

Prerequisites

Before getting started, make sure you have the following:

• WinSCP
• Windows 10 or Windows 11

Generating an RSA SSH Key Pair (Public + Private Key)

Step 1: Generate the Key Pair

Open Command Prompt, paste the following command, and press Enter.

ssh-keygen -m PEM -t rsa -b 2048

This command generates a 2048-bit RSA key pair in PEM format.

Step 2: Provide a File Name

When prompted, enter the file name for your key pair.

For example, I have used RSA Test -

Step 3: Enter a Passphrase

Next, you'll be prompted to enter a passphrase.

Note: The passphrase acts as an additional layer of security when using your private key to authenticate with the SFTP server. You'll be asked to enter this passphrase whenever the private key is used, so make sure to store it safely.

For security reasons, the passphrase won't be visible while typing.

Once the process completes, Windows will generate both the Public Key and Private Key in the selected directory.

Understanding the Public Key

If you open the .pub file in Notepad, you'll notice a comment at the end in the format: username@hostname

This comment is added automatically for identification purposes and is not required for authentication. If you don't want to share this information, you can safely remove it before sending the public key to the SFTP administrator.

Converting the Private Key to a .PPK File

Some SFTP clients, such as WinSCP, require the private key to be in PuTTY Private Key (.PPK) format.

Follow the steps below to convert your private key.

Step 1: Open WinSCP

Launch WinSCP and click Advanced.

Step 2: Navigate to SSH Authentication

Go to: SSH → Authentication

Click the three dots (...) button next to the Private Key field.

Step 3: Select Your Private Key

Change the file type to All Files (.) and select the private key file (the one without any extension).

Step 4: Save as a .PPK File

WinSCP will prompt you to import the key.

• Click OK
• Enter your passphrase
• Save the converted file as a .PPK

You should now see the .PPK file in the same directory.

You now have:

• ✅ Public Key (.pub)
• ✅ Private Key
• ✅ Converted .PPK file

These files can now be used while configuring your SFTP connection.

Learn More

For a deeper understanding of SSH keys and the underlying concepts, refer to Microsoft's official documentation:

Microsoft Learn – Create SSH keys

https://learn.microsoft.com/en-us/azure/virtual-machines/linux/create-ssh-keys-detailed

Hope this helps!

Aman K