Unable to import Ssh-Key with Passphrase

[spammads]

Vaultwarden Support String

asdf

Vaultwarden Build Version

latest

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

latest Nginx

Host/Server Operating System

Linux

Operating System Version

Mac Os latest

Clients

Desktop

Client Version

latest

Steps To Reproduce

1. Add Item
2. Choose SSH Key
3. Import key from clipboard
4. Enter Passphrase
5. Get Error-Message: "SshKey is invalid"

I tested the import with a standard-ssh-key (rsa, generated with ssh-keygen -t rsa -b 4096 -C "your_email@example.com") and this works

Expected Result

Import the key

Actual Result

Error Message that the key is invalid

Logs

No response

Screenshots or Videos

Additional Context

No response

[obstschale]

@spammads Did you find a solution? I have the same problems and I cannot figure out how to import my keys

[spammads]

Nope. I migrated to another password-provider (but not bc of this issue 🫣)

[strasharo]

Same here for me with both ed25519 and RSA keys. Has anyone found a workaround for this?

[bokkabonga]

Bit of a stretch here. But from https://bitwarden.com/help/ssh-agent/ "The SSH Agent requires release version 2025.1.2 or newer."

The current Webvault in Vaultwarden is "2025.1.1", so that might explain the problem. But even when this project updates to 2025.1.2 (or later) I´m not sure if the ssh-agent will be supported as it might be locked behind a different license...

[Peronia]

The problem also exists with vaultwarden version 1.34.1.

[Peronia]

I'm using version 1.34.3 now and still not able to save SSH keys in Vaultwarden.
I tried it via the desktop app on linux and mac. I tried my own password protected key and I copied that one that is generated when I hit + and try to paste it on a new entry. I see only "Ein Fehler ist aufgetreten" and nothing more.
A friend tried the same with underlying official Bitwarden and for him it works fine.
Are you aware of that @BlackDex (or any other, the discussion is quite old)?

[bokkabonga]

I just tried and got no problem with this via the desktop client. How did you generate your key? Does your key meet the following?

At this time, imported SSH keys from Putty are not compatible.

Imported keys must be in OpenSSH or PKCS#8 format.

[Peronia]

I created it years ago the default cli way. I used it nearly daily to connect with SSH.
It looks like this:

-----BEGIN OPENSSH PRIVATE KEY-----
hereyourkey
-----END OPENSSH PRIVATE KEY-----

So I would say this sould be fine. The key uses RSA.
Also - as I wrote - I tried to import that one that is generated from the desktop client itself. Thats also not working with the same error message.

[Peronia]

Okay, I stumbled across EXPERIMENTAL_CLIENT_FEATURE_FLAGS by chance (https://github.com/dani-garcia/vaultwarden/blob/main/.env.template#L384C37-L384C60). If you set ssh-agent and ssh-key-vault-item there, keys (RSA and ED25519) can be stored without a password. It still doesn't work with a password.
I haven't found any documentation on this.
Also, the default value fido2-vault-credentials doesn't make sense, as this value is not mentioned in the flags.