OPENSSL-GENRSA(1ossl)

💖 NAME 💖

openssl-genrsa — bestie, this is the one that generates an RSA private key for you. iconic behavior only ✨

So this page? It's from the <pink>OpenSSL</pink> fam — specifically the 1ossl manual set. Keep that in your back pocket 🫶

---

✨ SYNOPSIS ✨

openssl genrsa [-help] [-out filename] [-passout arg] [-aes128]
[-aes192] [-aes256] [-aria128] [-aria192] [-aria256] [-camellia128]
[-camellia192] [-camellia256] [-des] [-des3] [-idea] [-F4] [-f4] [-3]
[-primes num] [-verbose] [-quiet] [-traditional] [-rand files]
[-writerand file] [-engine id] [-provider name] [-provider-path path]
[-provparam [name:]key=value] [-propquery propq] [numbits]

like, yes, that's a lot of brackets. she's thorough 💅

---

🌸 DESCRIPTION 🌸

okay so the whole entire job of this command is: it generates an RSA private key. that's it. that's the tweet. 🎀

no cap, that's genuinely the whole description. she's a specialist, not a generalist.

---

🌈 OPTIONS 🌈

• -help — prints out a usage message for you. your lil built-in cheat sheet 🫶
• -out filename — writes the key out to the file you name. and if you don't pass this argument? standard output gets it instead. surprise delivery 🎁
• -passout arg — this is the password source for the output file. want the deets on the format? go look at openssl-passphrase-options(1) — she explains it way better than I could 💜
• -aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea — these bad boys encrypt the private key with the specified cipher before it gets output. it's giving security era 🔥 and here's the tea: if you specify none of these options, then no encryption is used at all. if encryption is used, it'll prompt you for a pass phrase — unless you already supplied one via the -passout argument 😌
• -F4, -f4, -3 — the public exponent to use, either 65537 or 3. default is 65537. also, heads up bestie: the -3 option has been deprecated 💀 (still listed, still real, just, y'know, old news)
• -primes num — tells it how many primes to use while generating the RSA key. the num parameter has to be a positive integer that's greater than 1 and less than 16. and if num is greater than 2, then the generated key is called a 'multi-prime' RSA key — which is defined in RFC 8017, so she's official 👑
• -verbose — prints extra details about the operations being performed. she's narrating her process 📣
• -quiet — prints fewer details about the operations being performed. lowkey handy during batch scripts and pipelines 🤫
• -traditional — writes the key using the traditional PKCS#1 format instead of the PKCS#8 format. vintage aesthetic, but make it cryptography 🎀
• -rand files, -writerand file — go peep "Random State Options" in openssl(1) for the details, bestie 🌸
• -engine id — see "Engine Options" in openssl(1). also — and I cannot stress this enough — this option is deprecated 💀
• -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — see "Provider Options" in openssl(1), plus provider(7) and property(7). the whole provider cinematic universe, honestly 🦋
• numbits — the size of the private key you want, in bits. ⚠️ this must be the last option specified. default is 2048, and values less than 512 are not allowed — do not test her, she will simply refuse 🙈

---

🧚 NOTES 🧚

ok so RSA private key generation essentially involves generating two or more prime numbers. while that's happening, various symbols get output to show you the progress — it's like a little loading screen but make it math ⭐

here's the legend, memorize it iykyk:

• . — represents each number which has passed an initial sieve test
• + — means a number has passed a single round of the Miller-Rabin primality test
• * — means the current prime starts a regenerating progress due to some failed tests
• a newline — means the number has passed all the prime tests (the actual number depends on the key size)

and because key generation is a random process, the time taken to generate a key may vary somewhat. kinda unpredictable, we love that for her 😭 but in general, more primes lead to less generation time of a key — so that's the tradeoff, periodt.

---

🔥 SEE ALSO 🔥

openssl(1), openssl-genpkey(1), openssl-gendsa(1) — go read the whole friend group 💖

---

👑 COPYRIGHT 👑

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

like, legal stuff but make it cute — read the license, bestie, it's not optional 🫶

---

mwah 💋 that's the whole page — brought to you by 3.5.9, dated 2026-09-29, straight from the OPENSSL-GENRSA(1ossl) manual. slay, go generate some keys ✨🔑