EC2 SSH 'Permission denied (publickey)' and Key File Errors

How to fix it

Try these in order — the most common fix is first.

1. 1. Use the right username

   Copy steps
   1. Amazon Linux: ec2-user; Ubuntu: ubuntu; Debian: admin; RHEL: ec2-user or root; Rocky: rocky; Bitnami: bitnami
   2. ssh -i key.pem ec2-user@<public-dns>
   Did this fix it? Yes No

2. 2. Confirm the key pair

   Copy steps
   1. EC2 > Instances > Details tab > Key pair name
   2. Use the matching .pem file
   Did this fix it? Yes No

3. 3. Fix key file permissions

   Copy steps
   1. macOS/Linux: chmod 0400 key.pem
   2. Windows: remove inherited permissions and grant yourself Read, or run icacls with /inheritance:r then /GRANT:R
   Did this fix it? Yes No

4. 4. Debug with verbose output

   Copy steps
   1. ssh -vvv -i key.pem user@host
   2. With PuTTY, convert .pem to .ppk using PuTTYgen (Load, then Save private key)
   Did this fix it? Yes No

5. 5. Lost the key

   Copy steps
   1. For EBS-backed instances: stop it, detach the root volume, attach it to a temporary instance, add a new public key to authorized_keys, reattach as the original device name and start
   2. Instance-store root volumes can't be recovered this way
   Did this fix it? Yes No

Symptoms

ssh says Permission denied (publickey), 'UNPROTECTED PRIVATE KEY FILE', 'Server refused our key' or 'unable to load key'.

Why it happens

• Wrong username for the AMI
• Wrong or different key pair
• Key file permissions too open
• Key in OpenSSH format where PEM or PuTTY .ppk is needed
• Permissions of ~/.ssh or authorized_keys changed on the instance
• Lost the private key

This guide also covers

• permission denied publickey ec2
• ec2 unprotected private key file
• aws ssh server refused our key
• ec2 ssh key pair lost

The same problem in other apps

All not loading, error messages & connection guides →

• DigitalOcean Droplet SSH Connection Refused or Timed Out (DigitalOcean)
• Vercel FUNCTION_INVOCATION_TIMEOUT (504) Error (Vercel)

Other AWS errors

• AWS Unexpected Charges: Why Is My AWS Bill So High?
• AWS Charges After Free Tier: Why Am I Being Billed?
• AWS Account Suspended: How to Reactivate It
• EC2 SSH Connection Timed Out
• S3 Access Denied (403 Forbidden) Error
• AWS 'Not Authorized to Perform' IAM Error
• Lambda 'Task timed out after 3.00 seconds' Error
• CloudFront 403 Error: The Request Could Not Be Satisfied