OPENSSL-GENPKEY(1ssl) OpenSSL OPENSSL-GENPKEY(1ssl) (NAME) openssl-genpkey - (SYNOPSIS) openssl genpkey [-help] [-out filename] [-outpubkey filename] [-outform DER|PEM] [-verbose] [-quiet] [-pass arg] [-cipher] [-paramfile file] [-algorithm alg] [-pkeyopt opt:value] [-genparam] [-text] [-rand files] [-writerand file] [-engine id] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] [-config configfile] (DESCRIPTION) . (OPTIONS) -help . -out filename . . -outpubkey filename . . -outform DER|PEM -genparam PEM . openssl-format-options(1) . -genparam -outform . -verbose (<>) . -quiet . -pass arg . arg openssl-passphrase-options(1) . -cipher . EVP_get_cipherbyname() . -aes-128-cbc AES CBC . -algorithm alg RSA DSA DH DHX. -pkeyopt . -paramfile -algorithm ( ) . (engines) (providers) . RSA RSA-PSS EC X25519 X448 ED25519 ED448 ML-DSA ML-KEM. ( -genparam ) DH DSA EC. X9.42 DH DHX PKCS#3 DH . DH DHX . -pkeyopt opt:value opt value. . "KEY GENERATION OPTIONS" "PARAMETER GENERATION OPTIONS" . opt : openssl genpkey -algorithm XXX -help -genparam . -algorithm -paramfile -pkeyopt . -paramfile filename . . . -pkeyopt . -paramfile -algorithm ( ) . -text () PEM DER. -rand files, -writerand file "Random State Options" openssl(1) . -engine id "Engine Options" openssl(1) . . -provider name -provider-path path -provparam [name:]key=value -propquery propq "Provider Options" openssl(1) provider(7) property(7) . -config configfile "Configuration Option" openssl(1) . (KEY GENERATION OPTIONS) . OpenSSL . X25519 X448 ED25519 ED448 . RSA (RSA Key Generation Options) rsa_keygen_bits:numbits . 2048 . rsa_keygen_primes:numprimes . 2 . rsa_keygen_pubexp:value RSA. "0x" . 65537 . RSA-PSS (RSA-PSS Key Generation Options) : RSA-PSS . rsa_keygen_bits:numbits, rsa_keygen_primes:numprimes, rsa_keygen_pubexp:value RSA . rsa_pss_keygen_md:digest digest . rsa_pss_keygen_mgf1_md:digest digest MGF1 . rsa_pss_keygen_saltlen:len len (salt) . EC (EC Key Generation Options) EC . ec_paramgen_curve:curve EC . OpenSSL NIST "P-256" . ec_param_enc:encoding . encoding named_curve explicit . named_curve . ML-DSA (ML-DSA Key Generation Options) hexseed:seed (seed) ML-DSA . . . . EVP_PKEY-ML-DSA(7) . ML-KEM (ML-KEM Key Generation Options) hexseed:seed (seed) ML-KEM . . . . EVP_PKEY-ML-KEM(7) . DH (DH Key Generation Options) group:name paramfile . "DH Parameter Generation Options" . (PARAMETER GENERATION OPTIONS) . OpenSSL . DSA (DSA Parameter Generation Options) dsa_paramgen_bits:numbits . 2048 . dsa_paramgen_q_bits:numbits qbits:numbits q. . 224 . dsa_paramgen_md:digest digest:digest . sha1 sha224 sha256 . q dsa_paramgen_q_bits . q sha1 q sha224 sha256 . properties:query (property query) digest . type:type . 1 FIPS186-2 . 0 FIPS186-4 . gindex:index g. 0 255 . . index g . g . -1 . hexseed:seed seed . . . DH (DH Parameter Generation Options) type group . group . group:name dh_param:name DH DH. . algorithm "DH" : "ffdhe2048" "ffdhe3072" "ffdhe4096" "ffdhe6144" "ffdhe8192" "modp_1536" "modp_2048" "modp_3072" "modp_4096" "modp_6144" "modp_8192". algorithm "DHX" RFC5114 : "dh_1024_160" "dh_2048_224" "dh_2048_256". dh_rfc5114:num RFC5114 . num 1 2 3 group "dh_1024_160" "dh_2048_224" "dh_2048_256" . . pbits:numbits dh_paramgen_prime_len:numbits p. 2048 . qbits:numbits dh_paramgen_subprime_len:numbits q. 224 . dh_paramgen_type DHX . safeprime-generator:value dh_paramgen_generator:value g. 2 . algorithm "DH" . type:string DH . : "generator" safeprime_generator. algorithm "DH" . "fips186_4" FIPS186-4. algorithm "DHX" . "fips186_2" FIPS186-2. algorithm "DHX" . "group" pbits "ffdhe2048" "ffdhe3072" "ffdhe4096" "ffdhe6144" "ffdhe8192" . algorithm "DH" . "default" algorithm . OpenSSL . algorithm "DH" "generator" . algorithm "DHX" "fips186_2" . dh_paramgen_type:value DH . 0 1 2 3 type "generator" "fips186_2" "fips186_4" "group" . digest:digest . sha1 sha224 sha256 . qbits qbits . q sha1 q sha224 sha256 . "fips186_4" "fips186_2" . properties:query digest . "fips186_4" "fips186_2" . gindex:index g. 0 255 . . index g . g . -1 . "fips186_4" "fips186_2" . hexseed:seed seed . . . "fips186_4" "fips186_2" . EC (EC Parameter Generation Options) EC . "EC Key Generation Options" . (NOTES) genpkey ENGINE . (EXAMPLES) RSA : openssl genpkey -algorithm RSA -out key.pem AES "hello": openssl genpkey -algorithm RSA -out key.pem -aes-128-cbc -pass pass:hello RSA : openssl genpkey -algorithm RSA -out key.pem \ -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 DSA : ( gindex seed pem ). openssl genpkey -genparam -algorithm DSA -out dsap.pem -pkeyopt pbits:2048 \ -pkeyopt qbits:224 -pkeyopt digest:SHA256 -pkeyopt gindex:1 -text DSA : openssl genpkey -paramfile dsap.pem -out dsakey.pem DH ffdhe4096: openssl genpkey -algorithm DH -out dhkey.pem -pkeyopt group:ffdhe4096 X9.42 DH RFC5114 group3: openssl genpkey -algorithm DHX -out dhkey.pem -pkeyopt dh_rfc5114:3 DH DH: openssl genpkey -paramfile dhp.pem -out dhkey.pem DH ffdhe2048: openssl genpkey -genparam -algorithm DH -out dhp.pem -pkeyopt group:ffdhe2048 X9.42 DH RFC5114 group2: openssl genpkey -genparam -algorithm DHX -out dhp.pem -pkeyopt dh_rfc5114:2 X9.42 DH FIP186-4: openssl genpkey -genparam -algorithm DHX -out dhp.pem -text \ -pkeyopt pbits:2048 -pkeyopt qbits:224 -pkeyopt digest:SHA256 \ -pkeyopt gindex:1 -pkeyopt dh_paramgen_type:2 X9.42 DH FIP186-2: openssl genpkey -genparam -algorithm DHX -out dhp.pem -text \ -pkeyopt pbits:1024 -pkeyopt qbits:160 -pkeyopt digest:SHA1 \ -pkeyopt gindex:1 -pkeyopt dh_paramgen_type:1 DH: openssl genpkey -genparam -algorithm DH -out dhp.pem \ -pkeyopt dh_paramgen_prime_len:2048 DH : openssl genpkey -genparam -algorithm DH -out dhpx.pem \ -pkeyopt dh_paramgen_prime_len:2048 \ -pkeyopt dh_paramgen_type:1 EC: openssl genpkey -genparam -algorithm EC -out ecp.pem \ -pkeyopt ec_paramgen_curve:secp384r1 \ -pkeyopt ec_param_enc:named_curve EC : openssl genpkey -paramfile ecp.pem -out eckey.pem EC: openssl genpkey -algorithm EC -out eckey.pem \ -pkeyopt ec_paramgen_curve:P-384 \ -pkeyopt ec_param_enc:named_curve X25519: openssl genpkey -algorithm X25519 -out xkey.pem ED448: openssl genpkey -algorithm ED448 -out xkey.pem ML-DSA-65: openssl genpkey -algorithm ML-DSA-65 -out ml-dsa-key.pem ML-KEM-768: openssl genpkey -algorithm ML-KEM-768 -out ml-kem-key.pem (SEE ALSO) openssl(1), openssl-pkey(1), openssl-rsa(1), openssl-dsa(1), openssl-genrsa(1), openssl-gendsa(1) (HISTORY) NIST EC OpenSSL 1.0.2 . X25519 OpenSSL 1.1.0 . X448 ED25519 ED448 OpenSSL 1.1.1 . -engine OpenSSL 3.0 . ML-DSA ML-KEM OpenSSL 3.5 . (COPYRIGHT) Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved. . (Apache License 2.0) (<<>>). . LICENSE . 3.6.4 2026-08-25 OPENSSL-GENPKEY(1ssl)