OPENSSL-DHPARAM(1ossl)

💅 NAME 💅

ok so openssl-dhparam — it's the openssl manual page (1ossl, iykyk) for doing DH parameter manipulation and generation. that's the whole vibe. manipulating params, generating params, being iconic about it. 🎀

---

✨ SYNOPSIS ✨

openssl dhparam [-help] [-inform DER|PEM] [-outform DER|PEM] [-in
filename] [-out filename] [-dsaparam] [-check] [-noout] [-text]
[-verbose] [-quiet] [-2] [-3] [-5] [-engine id] [-rand files]
[-writerand file] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq] [numbits]

---

🦋 DESCRIPTION 🦋

bestie, this command is literally just here to manipulate DH parameter files. that's it, that's the job, and it does it gorgeously.

also!! if you wanna know how to generate a key using a named safe prime group — you know, the ✨no intermediate parameters✨ route — go peek at the "EXAMPLES" section in openssl-genpkey(1). it's giving efficient. 💅

---

🌸 OPTIONS 🌸

• -help — prints out a usage message, for when you're like "wait what were the flags again" 🙈
• -inform DER|PEM, -outform DER|PEM — the input format and the output format, and the default is PEM. the object is compatible with the PKCS#3 DHparameter structure. wanna know more? openssl-format-options(1) has the details, slay. ✨
• -in filename — tells it which input file to read parameters from. don't specify it? then it reads from standard input. easy.
• -out filename — tells it which output file to write parameters to. no option present? standard output it is. 🫶 and yes, the output filename can literally be the same as the input filename, which means the file contents get replaced. > but heads up bestie: file I/O is not atomic. the output file gets truncated and then written. so like... be aware. 😭
• -dsaparam — use this and it reads or creates DSA parameters instead of DH ones, then converts them to DH format. otherwise? safe primes get used for DH parameter generation (safe meaning (p-1)/2 is also prime, cute).

DH parameter generation with the -dsaparam option is much faster. but beware!! ⚠️ with such DSA-style DH parameters, you should create a fresh DH key for each use, otherwise small-subgroup attacks may be possible. no cap, don't skip that part.

• -check — performs numerous checks to see if the supplied parameters are valid, and displays a warning if they're not. it's giving quality control. 👑
• -2, -3, -5 — the generator to use: either 2, 3 or 5. if one of these is present then the input file is ignored and parameters are generated instead. if none is present but numbits is, parameters are generated with the default generator 2. 🌈
• numbits — says "generate me a parameter set of size numbits." it must be the last option. if it's present then the input file is ignored and parameters are generated instead. if it's not present but a generator (-2, -3 or -5) is, parameters are generated with a default length of 2048 bits. minimum length is 512 bits, maximum length is 10000 bits. respect the range bestie 💀
• -noout — inhibits the output of the encoded version of the parameters. sometimes you just don't wanna see it, and that's valid.
• -text — prints out the DH parameters in human readable form. for the girlies who like to read their parameters. 📖💖
• -engine id — see "Engine Options" in openssl(1). > this option is deprecated, just so you know. 🚩
• -rand files, -writerand file — see "Random State Options" in openssl(1) for all the deets.
• -provider name
• -provider-path path
• -provparam [name:]key=value
• -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). the provider lore runs deep, iykyk.
• -verbose — enables the output of progress messages, which is handy when you're running commands interactively that may take a longass time to execute. like yes tell me what's happening, i'm invested. 🔥
• -quiet — suppresses the output of progress messages, which may be undesirable in batch scripts or pipelines. shhh era. 🤫

---

🧚 NOTES 🧚

this command replaces the dh and gendh commands of previous releases. glow-up moment fr fr. ✨

---

⭐ SEE ALSO ⭐

openssl(1), openssl-pkeyparam(1), openssl-dsaparam(1), openssl-genpkey(1).

---

💜 HISTORY 💜

• the -engine option was deprecated in OpenSSL 3.0.
• the -C option was removed in OpenSSL 3.0. gone gone, she's not coming back 💀

---

🎀 COPYRIGHT 🎀

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

ok that's the whole page, you're so welcome 🫶 this was OPENSSL-DHPARAM(1ossl), version 3.5.9, dated 2026-09-29 — screenshot it, bookmark it, put it on your fridge, mwah 🍓💅✨