OPENSSL-DSA(1ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💜 OPENSSL-DSA(1ossl) — the DSA key glow-up page

okay so bestie, welcome to the openssl-dsa page from the OpenSSL manual (that's the 1ossl bit, iykyk). it's all about DSA key processing, and honestly it's giving "small but mighty" ✨

🦋 NAME

openssl-dsa — DSA key processing, literally that's the whole job description 💅

🎀 SYNOPSIS

openssl dsa [-help] [-inform DER|PEM] [-outform DER|PEM] [-in filename]
[-passin arg] [-out filename] [-passout arg] [-aes128] [-aes192]
[-aes256] [-aria128] [-aria192] [-aria256] [-camellia128] [-camellia192]
[-camellia256] [-des] [-des3] [-idea] [-text] [-noout] [-modulus]
[-pubin] [-pubout] [-pvk-strong] [-pvk-weak] [-pvk-none] [-engine id]
[-provider name] [-provider-path path] [-provparam [name:]key=value]
[-propquery propq]

yes it's long. yes every single one of those flags is real. no we're not skipping any 🫶

🌸 DESCRIPTION

so this command processes DSA keys. that's it, that's the vibe. it can convert them between the various forms and print their components out for you 👑

note, bestie, read this one: this command uses the traditional SSLeay compatible format for private key encryption. newer applications should use the more secure PKCS#8 format using the pkcs8 — that's the glow-up, ok? 💖

✨ OPTIONS ✨

  • -help — prints out a usage message. tiny little helper, we love her.
  • -inform DER|PEM — the format of the key going in; unspecified by default. peek at openssl-format-options(1) for the deets.
  • -outform DER|PEM — the format of the key going out; the default is PEM. again, openssl-format-options(1) has the details.

real talk though, here's what the formats actually hold: private keys are a sequence of ASN.1 INTEGERS — the version (zero), p, q, g, and the public and private key components. public keys are a SubjectPublicKeyInfo structure with the DSA type. and the PEM format also accepts PKCS#8 data 💫

  • -in filename — which file to read a key from, or standard input if you don't specify this option. if the key is encrypted, it's gonna prompt you for a pass phrase.
  • -out filename — which file to write a key to, or standard output if it's not specified. if you set any encryption options then it'll prompt for a pass phrase. the output filename should not be the same as the input filename — like, do not do that, pls 🙈
  • -passin arg, -passout arg — the password source for the input and output file respectively. for more on the format of arg, go read openssl-passphrase-options(1).
  • -aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea — these encrypt the private key with the specified cipher before outputting it, and a pass phrase gets prompted for. if none of these options is specified the key is written in plain text. which means: you can use this command to remove the pass phrase from a key by not giving any encryption option, or to add or change the pass phrase by setting them. these options can only be used with PEM format output files — no PEM, no cipher, periodt 💅
  • -text — prints out the public and private key components and the parameters. all the juicy bits 🌈
  • -noout — prevents output of the encoded version of the key. sometimes you just don't want the whole thing, you know?
  • -modulus — prints out the value of the public key component of the key.
  • -pubin — by default a private key is read from the input. with this option, a public key is read instead. and if the input contains no public key but a private key? its public part is used. clever, right? 🧚
  • -pubout — by default a private key is output. with this option a public key gets output instead. this option is automatically set if the input is a public key. automatic slay ⭐
  • -pvk-strong — enable the 'Strong' PVK encoding level (this one is the default, fyi).
  • -pvk-weak — enable the 'Weak' PVK encoding level.
  • -pvk-none — don't enforce PVK encoding.
  • -engine id — see "Engine Options" in openssl(1). this option is deprecated — treat it like an old trend, it's over 💀
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq

these four hang together: see "Provider Options" in openssl(1), provider(7), and property(7).

okay and one more thing before we move on — the openssl-pkey(1) command is capable of performing all the operations this command can, plus it supports other public key types. so like, options ✨

🔥 EXAMPLES

the documentation for the openssl-pkey(1) command contains examples equivalent to the ones listed here. but here are the DSA ones anyway, because we ate:

to remove the pass phrase on a DSA private key:

 openssl dsa -in key.pem -out keyout.pem

to encrypt a private key using triple DES:

 openssl dsa -in key.pem -des3 -out keyout.pem

to convert a private key from PEM to DER format:

 openssl dsa -in key.pem -outform DER -out keyout.der

to print out the components of a private key to standard output:

 openssl dsa -in key.pem -text -noout

to just output the public part of a private key:

 openssl dsa -in key.pem -pubout -out pubkey.pem

👑 SEE ALSO

openssl(1), openssl-pkey(1), openssl-dsaparam(1), openssl-gendsa(1), openssl-rsa(1), openssl-genrsa(1)

💀 HISTORY

the -engine option was deprecated in OpenSSL 3.0. that's the whole history section, she's brief 🎀

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the page, bestie 🫶 this was OpenSSL 3.5.6, dated 2026-04-07 — mwah, go process some keys 💋

📦 where this page comes from