I have a PEM file which I add to a running ssh-agent:

$ file query.pem
query.pem: PEM RSA private key

$ ssh-add ./query.pem
Identity added: ./query.pem (./query.pem)

$ ssh-add -l | grep query
2048 ef:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX ./query.pem (RSA)

My question is how I can get the key fingerprint I see in ssh-agent directly from the file. I know ssh-keygen -l -f some_key works for "normal" ssh keys, but not for PEM files.

If I try ssh-keygen on the .pem file, I get:

$ ssh-keygen -l -f ./query.pem                                             
key_read: uudecode PRIVATE KEY----- failed
key_read: uudecode PRIVATE KEY----- failed
./query.pem is not a public key file.

This key starts with:

-----BEGIN RSA PRIVATE KEY-----
MIIEp.... etc.

as opposed to a "regular" private key, which looks like:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,E15F2.... etc.