OPENSSL-RSA(1ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💅 NAME 💅

okay so bestie, welcome to openssl-rsa — the RSA key processing command ✨ (this is page openssl-rsa(1ossl) from the OpenSSL manual, and yes she's iconic)

✨ SYNOPSIS ✨

openssl rsa [-help] [-inform DER|PEM|P12|ENGINE] [-outform DER|PEM] [-in
filename|uri] [-passin arg] [-out filename] [-passout arg] [-aes128]
[-aes192] [-aes256] [-aria128] [-aria192] [-aria256] [-camellia128]
[-camellia192] [-camellia256] [-des] [-des3] [-idea] [-text] [-noout]
[-modulus] [-traditional] [-check] [-pubin] [-pubout] [-RSAPublicKey_in]
[-RSAPublicKey_out] [-pvk-strong] [-pvk-weak] [-pvk-none] [-engine id]
[-provider name] [-provider-path path] [-provparam [name:]key=value]
[-propquery propq]

🦋 DESCRIPTION 🦋

So this command processes RSA keys. That's the whole vibe. It can convert them between the various forms, and it can print their components out 💖. Simple as that, no cap.

🎀 OPTIONS 🎀

  • -help — prints out a lil usage message so you know what's what 🫶
  • -inform DER|PEM|P12|ENGINE — the input format of the key. unspecified by default. the details live in openssl-format-options(1) ✨
  • -outform DER|PEM — the output format of the key. default is PEM. again, openssl-format-options(1) has the tea 💅
  • -traditional — when you're writing out a private key, use the traditional PKCS#1 format instead of PKCS#8. old school, lowkey iconic 💜
  • -in filename|uri — tells it where to read the key from, or it'll read standard input if you don't say anything. if the key is encrypted, it's gonna prompt you for a pass phrase, so be ready 😭
  • -passin arg, -passout arg — the password source for the input file and the output file respectively. all the format lore about arg is in openssl-passphrase-options(1) 🔥
  • -out filename — where to write the key out to, or standard output if you don't specify. if you've set any encryption options, it's gonna prompt you for a pass phrase. and bestie, listen: the output filename should not be the same as the input filename 💀
  • -aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea — these encrypt the private key with the cipher you picked before it gets outputted. a pass phrase gets prompted for. if you don't pick any of these, the key gets written in plain text 😳 which means: this command can remove the pass phrase from a key (just don't give any encryption option), or add or change the pass phrase by setting them. these options can only be used with PEM format output files, periodt ✋
  • -text — prints out the various public or private key components in plain text, in addition to the encoded version 🎀
  • -noout — stops it from outputting the encoded version of the key. so you get the extra stuff without the blob 🦋
  • -modulus — prints out the value of the modulus of the key 🔢
  • -check — checks the consistency of an RSA private key. a little wellness check for your key 🩺
  • -pubin — by default a private key is read from the input; with this, a public key is read instead. and if the input has no public key but does have a private key, its public part gets used 💖
  • -pubout — by default a private key is output; with this, a public key gets output instead. and it's automatically set if the input is a public key. slay, she self-manages ✨
  • -RSAPublicKey_in, -RSAPublicKey_out — same energy as -pubin and -pubout, except the RSAPublicKey format is used instead 🎀
  • -pvk-strong — enable the 'Strong' PVK encoding level (this is the default) 💪
  • -pvk-weak — enable the 'Weak' PVK encoding level 🥀
  • -pvk-none — don't enforce PVK encoding at all, she's free 🦋
  • -engine id — see "Engine Options" in openssl(1). this option is deprecated 🚩
  • -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7) 📚

🌸 NOTES 🌸

The openssl-pkey(1) command can do everything this command can do, plus it supports other public key types. so she's the overachiever of the family, we love her 👑

🍓 EXAMPLES 🍓

the docs for openssl-pkey(1) have examples equivalent to the ones listed here, but here they are anyway because we're thorough 💅

To remove the pass phrase on an RSA private key:

openssl rsa -in key.pem -out keyout.pem

To encrypt a private key using triple DES:

openssl rsa -in key.pem -des3 -out keyout.pem

To convert a private key from PEM to DER format:

openssl rsa -in key.pem -outform DER -out keyout.der

To print out the components of a private key to standard output:

openssl rsa -in key.pem -text -noout

To just output the public part of a private key:

openssl rsa -in key.pem -pubout -out pubkey.pem

Output the public part of a private key in RSAPublicKey format:

openssl rsa -in key.pem -RSAPublicKey_out -out pubkey.pem

💀 BUGS 💀

ngl there should be an option that automatically handles .key files, without you having to manually edit them 😭 like bestie we're doing this by hand in 2026?? anyway that's the known gap 🫠

🌈 SEE ALSO 🌈

openssl(1), openssl-pkey(1), openssl-pkcs8(1), openssl-dsa(1), openssl-genrsa(1), openssl-gendsa(1) 🫶

⭐ HISTORY ⭐

The -engine option was deprecated in OpenSSL 3.0 📜

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>. 💖

okay that's the whole page bestie, go forth and process those keys 🧚✨ this was OpenSSL 3.5.6, dated 2026-04-07, from the OpenSSL source distribution — mwah, study hard, ily 🫶💜

📦 where this page comes from