gendsa.1s

gendsa [-out filename] [-passout arg] [-des | -des3 | -aes128 | -aes192 | -aes256 | -camellia128 | -camellia192 | -camellia256 | -seed | -idea] [-text] [-noout] [-genkey] [-traditional] [-f4] [-3] [-rand files] [-engine id] [-provider name] [-provider_path path] [-propquery propq] <dsa-parameter-file>

-out filename
    Output private key to file (default: stdout)

-passout arg
    Passphrase source for encryption (e.g., pass:foo)

-des / -des3 / -aes128 etc.
    Encrypt output with specified cipher

-text
    Print key in text form

-noout
    No output; just decrypt/verify

-rand files
    Files for random seed

-engine id
    Use specific crypto engine

-provider name
    Legacy or default provider (OpenSSL 3+)

<dsa-parameter-file>
    Required input DSA params file

gendsa is an OpenSSL utility for generating a DSA (Digital Signature Algorithm) private key from a provided DSA parameters file. It reads DSA parameters (generated via dsaparam) and produces a PEM-encoded private key, optionally encrypting it with symmetric ciphers and a passphrase.

DSA keys are used for digital signatures, particularly in protocols like SSH or TLS certificates. The command supports various encryption algorithms for key protection, such as DES, AES, and Camellia. Output defaults to PEM format unless specified otherwise.

Key workflow: First create parameters with dsaparam -genkey 2048 -out params.pem, then gendsa -out private.pem params.pem.

Important: gendsa is deprecated in OpenSSL 1.1.0+ and scheduled for removal. Use genpkey -algorithm DSA -out private.pem for new applications, as it handles parameters internally and supports modern providers.

Deprecated in OpenSSL 1.1.0+; use genpkey instead. DSA is weakening; prefer ECDSA or EdDSA. Requires params file upfront.

Generate params: openssl dsaparam 2048 -out dsa_params.pem
Generate key: openssl gendsa -aes256 -out dsa_private.pem dsa_params.pem
Enter passphrase when prompted.

openssl genpkey -algorithm DSA -out dsa_private.pem -pkeyopt bits:2048 -aes256 (generates params + key in one step)

Part of OpenSSL since ~0.9.x (1998); designed for DSA param-based key gen. Deprecated in 1.1.0 (2016) with app migration to genpkey; legacy support in 3.x via providers.

dsaparam(1), genpkey(1), dsa(1), openssl(1)