OPENSSL-PKEY(1ossl)

💖 openssl-pkey(1ossl) 💖

okay so bestie, this is the openssl pkey page — the public or private key processing command from the OpenSSL fam. It's basically the glow-up station for your keys: convert them between forms, print their components, that whole vibe. ✨

---

🌸 SYNOPSIS 🌸

openssl pkey [-help] [-engine id] [-provider name] [-provider-path path]
[-provparam [name:]key=value] [-propquery propq] [-check] [-pubcheck]
[-in filename|uri] [-inform DER|PEM|P12|ENGINE] [-passin arg] [-pubin]
[-out filename] [-outform DER|PEM] [-cipher] [-passout arg]
[-traditional] [-pubout] [-noout] [-text] [-text_pub] [-ec_conv_form
arg] [-ec_param_enc arg]

---

🦋 DESCRIPTION 🦋

So this command processes public or private keys — like, it's the main character of key handling. You can convert them between the various forms and print out their components. That's the whole gig. 💅

---

🎀 OPTIONS 🎀

⭐ General options

• -help — prints a usage message. classic, love that for us.
• -engine id — see "Engine Options" in openssl(1). ngl bestie, this option is deprecated 💀.
• -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — all of these live in "Provider Options" in openssl(1), plus provider(7) and property(7). go read those, iykyk 🫶
• -check — checks the consistency of a key pair, for both the public and private components. consistency check, slay.
• -pubcheck — checks the correctness of either a public key or the public component of a key pair. just the public part getting its moment ✨

🌈 Input options

• -in filename|uri — tells it which input file to read a key from. no option? then it reads from standard input, easy. and hey — if the key input is encrypted and you didn't give -passin, it'll prompt you for a pass phrase. no cap.
• -inform DER|PEM|P12|ENGINE — the key input format. unspecified by default. details live in openssl-format-options(1) 📚
• -passin arg — the password source for the key input. for the format of arg, go see openssl-passphrase-options(1).
• -pubin — by default a private key is read from the input. with this option, a public key is read instead. and if the input has no public key but does have a private key, its public part is used. flexible king 👑

🧚 Output options

• -out filename — the output file where the encoded and/or text output of the key gets saved; if you don't specify it, standard output. ⚠️ heads up: the output filename can be the same as the input filename, which literally replaces the file contents. and note, file I/O is not atomic — the output file gets truncated and then written. so yeah, be careful bestie 😭

Also: if any cipher option is set but no -passout is given, a pass phrase will be prompted for. and if the password input gets interrupted, the output file is not touched — small mercy 💖

• -outform DER|PEM — the key output format. default is PEM. see openssl-format-options(1) for the deets.
• -cipher — encrypts the PEM encoded private key with the supplied cipher. any algorithm name that EVP_get_cipherbyname() accepts is fine, like aes128. 🚨 but encryption is not supported for DER output, periodt.
• -passout arg — the password source for the output file. for the format of arg, see openssl-passphrase-options(1).
• -traditional — normally a private key is written in the standard format: PKCS#8 with the appropriate encryption algorithm (if any). specify -traditional and you get the older "traditional" format instead. retro vibes 🎀
• -pubout — by default the private and public key are output; this restricts the output to just the public components. it's automatically set if the input is a public key, cute. and when you combine it with -text, it's equivalent to -text_pub. ✨
• -noout — doesn't output the key in encoded form. just… no out. simple as that.
• -text — outputs the various key components in plain text (possibly in addition to the PEM encoded form). cannot be combined with encoded output in DER format, so don't even try 💀
• -text_pub — outputs in text form only the public key components (also for private keys, yes really). also cannot be combined with encoded output in DER format. same rule, same energy.
• -ec_conv_form arg — this one only applies to elliptic-curve based keys 💜. it specifies how points on the elliptic curve get converted into octet strings. possible values:
  • compressed (the default value)
  • uncompressed
  • hybrid

for more info on point conversion forms, read the X9.62 standard. 📖 note: due to patent issues, the compressed option is disabled by default for binary curves and can be enabled by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at compile time. patents, am i right 🙈

• -ec_param_enc arg — only applies to elliptic curve based public and private keys. specifies how the elliptic curve parameters are encoded. possible values:
  • named_curve — the ec parameters are specified by an OID (this is the default value)
  • explicit — the ec parameters are explicitly given (see RFC 3279 for the definition of the EC parameters structures)

note: the implicitlyCA alternative, as specified in RFC 3279, is currently not implemented in OpenSSL. so don't come for it, it's not there 💀

---

🍓 EXAMPLES 🍓

Wanna remove the pass phrase on a private key? say less:

openssl pkey -in key.pem -out keyout.pem

Encrypt a private key using triple DES:

openssl pkey -in key.pem -des3 -out keyout.pem

Convert a private key from PEM to DER format:

openssl pkey -in key.pem -outform DER -out keyout.der

Print out the components of a private key to standard output:

openssl pkey -in key.pem -text -noout

Print out the public components of a private key to standard output:

openssl pkey -in key.pem -text_pub -noout

Just output the public part of a private key:

openssl pkey -in key.pem -pubout -out pubkey.pem

Change the EC parameters encoding to explicit:

openssl pkey -in key.pem -ec_param_enc explicit -out keyout.pem

Change the EC point conversion form to compressed:

openssl pkey -in key.pem -ec_conv_form compressed -out keyout.pem

---

👀 SEE ALSO 👀

openssl(1), openssl-genpkey(1), openssl-rsa(1), openssl-pkcs8(1), openssl-dsa(1), openssl-genrsa(1), openssl-gendsa(1) — go read the whole friend group 💅

---

💀 HISTORY 💀

The -engine option was deprecated in OpenSSL 3.0. rip to a real one 🫡

---

👑 COPYRIGHT 👑

Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the page bestie 🫶 this whole thing is from OpenSSL 3.5.0, dated 2026-09-25, page OPENSSL-PKEY(1ossl) — iconic, no notes ✨🎀💖