OPENSSL-ECPARAM(1ossl)

💜 NAME 💜

ok so openssl-ecparam — it's the OpenSSL manual page for EC parameter manipulation and generation, bestie. that's the whole vibe. elliptic curve params, we manipulate em, we generate em. slay.

---

✨ SYNOPSIS ✨

openssl ecparam [-help] [-inform DER|PEM] [-outform DER|PEM] [-in
filename] [-out filename] [-noout] [-text] [-check] [-check_named]
[-name arg] [-list_curves] [-conv_form arg] [-param_enc arg] [-no_seed]
[-genkey] [-engine id] [-rand files] [-writerand file] [-provider name]
[-provider-path path] [-provparam [name:]key=value] [-propquery propq]

like, that's a LOT of flags but we're gonna get through them together, i promise 🫶

---

🦋 DESCRIPTION 🦋

okay so this command does exactly what it says on the tin: it manipulates or generates EC parameter files. that's it. that's the whole job.

but here's the tea ☕ — OpenSSL is currently not able to generate new groups, so this command can only create EC parameters from known (named) curves. no inventing new curves from scratch, bestie. not today. not in this version. it's giving "we work with what we have" energy.

---

🎀 OPTIONS 🎀

• -help — prints out a usage message. the classic "what do i even do here" button 💅
• -inform DER|PEM — this sets the EC parameters input format, and ngl it's unspecified by default. check openssl-format-options(1) for the deets.
• -outform DER|PEM — the EC parameters output format, and the default here is PEM. see openssl-format-options(1) for details. also, heads up: parameters are encoded as EcpkParameters as specified in IETF RFC 3279 📜
• -in filename — tells it which input file to read parameters from. if you don't pass this, it just reads from standard input. no biggie.
• -out filename — where the output filename parameters go. if it's not present, standard output gets used instead. and lowkey here's the spicy bit: the output filename can be the same as the input filename, which means it replaces the file contents. and note — file I/O is not atomic. the output file gets truncated and then written. so like, don't come for me if something goes sideways mid-write 😭
• -noout — this inhibits the output of the encoded version of the parameters. basically "don't print that part, thanks."
• -text — prints out the EC parameters in human readable form. for when you wanna actually read the thing 👀
• -check — validates the elliptic curve parameters. vibes check, but for curves ✅
• -check_named — validates the elliptic name curve parameters by checking if the curve parameters match any built-in curves. it's like matching your outfit against the whole closet 💅
• -name arg — uses the EC parameters with the specified 'short' name. use -list_curves to get a list of all currently implemented EC parameters. iykyk.
• -list_curves — prints out a list of all currently implemented EC parameters names and then exits. it's giving "i showed you the menu, now i'm leaving" 🚪
• -conv_form arg — this specifies how the points on the elliptic curve get converted into octet strings. possible values are: compressed, uncompressed (the default value) and hybrid. for more info on point conversion forms, go read the X9.62 standard 📚. note: due to patent issues, compressed is disabled by default for binary curves and can be enabled by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at compile time. yeah. patents. in this economy. 💀
• -param_enc arg — this specifies how the elliptic curve parameters are encoded. possible value are: named_curve, i.e. the ec parameters are specified by an OID, or explicit where the ec parameters are explicitly given (see RFC 3279 for the definition of the EC parameters structures). the default value is named_curve. note: the implicitlyCA alternative, as specified in RFC 3279, is currently not implemented in OpenSSL. so don't try it, bestie 🙈
• -no_seed — this inhibits the 'seed' for the parameter generation from being included in the ECParameters structure (see RFC 3279). keeping secrets 🤫
• -genkey — this will generate an EC private key using the specified parameters. now we're cooking 🔥
• -engine id — see "Engine Options" in openssl(1). and psst — this option is deprecated. it's giving legacy. it's giving 3.0 energy.
• -rand files, -writerand file — see "Random State Options" in openssl(1) for details. randomness queen 🌈
• -provider name
• -provider-path path
• -provparam [name:]key=value
• -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). provider lore, go read it ✨

---

also real talk for a sec: the openssl-genpkey(1) and openssl-pkeyparam(1) commands are capable of performing all the operations this command can, as well as supporting other public key types. so like... this one still slays, but those two are the multi-hyphenate icons 👑

---

🌸 EXAMPLES 🌸

the docs for the openssl-genpkey(1) and openssl-pkeyparam(1) commands contain examples equivalent to the ones listed here. but here's the rundown anyway, because i love you 💖

to create EC parameters with the group 'prime192v1':

openssl ecparam -out ec_param.pem -name prime192v1

to create EC parameters with explicit parameters:

openssl ecparam -out ec_param.pem -name prime192v1 -param_enc explicit

to validate given EC parameters:

openssl ecparam -in ec_param.pem -check

to create EC parameters and a private key:

openssl ecparam -out ec_key.pem -name prime192v1 -genkey

to change the point encoding to 'compressed':

openssl ecparam -in ec_in.pem -out ec_out.pem -conv_form compressed

to print out the EC parameters to standard output:

openssl ecparam -in ec_param.pem -noout -text

---

⭐ SEE ALSO ⭐

openssl(1), openssl-pkeyparam(1), openssl-genpkey(1), openssl-ec(1), openssl-dsaparam(1)

like, go read those too. they're all linked in the group chat 🫶

---

🧚 HISTORY 🧚

• the -engine option was deprecated in OpenSSL 3.0.
• the -C option was removed in OpenSSL 3.0. gone. not coming back. rip bozo 💀

---

👑 COPYRIGHT 👑

Copyright 2003-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay and that's the whole page, bestie!! 🎀 this one's from OpenSSL 3.5.0, dated 2026-09-25 — so if you're reading this, hi from the future, hope your curves are valid and your parameters are named 💜✨ slay, periodt, go check your params 🦋