OPENSSL-SKEYUTL(1ossl)

💅 OPENSSL-SKEYUTL(1ossl) — the one from the OpenSSL manual pages ✨

okay so bestie, grab a boba, because we're talking about openssl-skeyutl — that's the skeyutl command from the OpenSSL family, and it's literally the glow-up for opaque symmetric keys. 🎀

---

✨ NAME ✨

openssl-skeyutl — the opaque symmetric keys routines, and yes she's serving key-management realness 👑

---

🌸 SYNOPSIS 🌸

openssl skeyutl [-help] [-cipher cipher] [-skeymgmt skeymgmt] [-skeyopt
opt:value] [-genkey] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq]

that's the whole vibe check right there — slay 💅

---

🦋 DESCRIPTION 🦋

okay so here's the tea, and it's kind of a plot twist: not all cipher implementations support keys as raw bytes. 😭 Like, PKCS#11 tokens can store them internally, and there is no option at all to get the raw byte representation out of them. literally none. the key stays in the vault, bestie.

So this tool? It's designed for managing opaque symmetric keys — like, keys you can't just peek at as a byte string. main character energy for the key-management girlies 🧚

---

💜 OPTIONS 💜

• -help — prints out a usage message. our lil "what am i even doing" button 🫶
• -cipher cipher — tells it which cipher to generate the key for.
• -skeymgmt skeymgmt — some providers may support opaque symmetric key objects, and to use them we need to know the skeymgmt. If you don't specify it, the name of the cipher will be used instead (default behavior, no cap).

To find out the name of the suitable symmetric key management, please refer to the output of the openssl list -skey-managers command. go look, i'll wait 💅

• -skeyopt opt:value — to obtain an existing opaque symmetric key or to generate a new one, key options are specified as opt:value.

🚨 okay important: these options can't be used together with any options implying raw key either directly or indirectly. no mixing, periodt.

• -genkey — generate a new opaque key object. new key, who dis 🔥
• -provider name
• -provider-path path
• -provparam [name:]key=value
• -propquery propq — all four of these are provider things! see "Provider Options" in openssl(1), provider(7), and property(7). iykyk ✨

---

🌈 SEE ALSO 🌈

openssl-enc(1), EVP_SKEY(3) — go read them, they're iconic too 💖

---

⭐ HISTORY ⭐

The skeyutl command was added in OpenSSL 3.5. so she's a newer release and she knows it 🎀

---

👑 COPYRIGHT 👑

Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

fr fr, read the license, it's the rules 🫶

---

and that's the whole page, bestie!! this was OpenSSL 3.5.9, dated 2026-09-29, and the page itself is OPENSSL-SKEYUTL(1ossl) — go forth and manage those opaque keys, you gorgeous nerd 💖✨🌸