LinuxCommandLibrary
GitHubF-DroidGoogle Play Store

genpkey.1s

OpenSSL private key generation utility

TLDR

Generate RSA key
$ openssl genpkey -algorithm RSA -out [key.pem]
copy
Generate with size
$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:[4096] -out [key.pem]
copy
Generate EC key
$ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:[P-256] -out [key.pem]
copy
Generate Ed25519 key
$ openssl genpkey -algorithm ED25519 -out [key.pem]
copy
Generate RSA key encrypted with a passphrase
$ openssl genpkey -algorithm RSA -aes256 -out [key.pem]
copy
Generate key with passphrase from stdin
$ openssl genpkey -algorithm RSA -aes256 -pass stdin -out [key.pem]
copy

SYNOPSIS

openssl genpkey [options]

DESCRIPTION

genpkey is the OpenSSL unified command for generating private keys. It supports RSA, EC (NIST curves), Ed25519, Ed448, X25519, and X448 algorithms through a consistent interface.The tool creates private keys for TLS certificates, code signing, and other cryptographic uses. It supersedes older algorithm-specific commands like genrsa and gendsa with a single, more flexible interface.genpkey is the recommended way to generate keys since OpenSSL 1.0.0. For RSA, the default key size is 2048 bits; 4096 bits is recommended for higher security.

PARAMETERS

-algorithm ALG

Key algorithm: RSA, EC, ED25519, ED448, X25519, X448.
-out FILE
Output file (default: stdout).
-pkeyopt OPT:VALUE
Algorithm-specific option (e.g., rsakeygenbits:4096, ecparamgencurve:P-256).
-aes256
Encrypt output key with AES-256-CBC.
-pass ARG
Passphrase source for encryption: pass:phrase, stdin, file:path, env:var.
-outform FORMAT
Output format: PEM (default), DER.
-text
Print key details in human-readable form in addition to encoded output.
-help
Display help information.

CAVEATS

Key security depends on parameters. Protect private keys. Algorithm support varies by OpenSSL version.

HISTORY

genpkey was added to OpenSSL as a unified key generation command, replacing algorithm-specific commands like genrsa and gendsa with a consistent interface.

SEE ALSO

openssl(1), openssl-genrsa(1), openssl-pkey(1), openssl-req(1)

Copied to clipboard
Kai