OPENSSL-GENRSA(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 openssl-genrsa — it's giving key generation, bestie

okay so this is openssl-genrsa from the 1SSL manual, and it literally does one thing and does it gorgeously: it makes you an RSA private key. 🎀

✨ NAME ✨

openssl-genrsa — generate an RSA private key. that's it. that's the whole job. queen behavior. 👑

🌸 SYNOPSIS 🌸

openssl genrsa [-help] [-out filename] [-passout arg] [-aes128]
[-aes192] [-aes256] [-aria128] [-aria192] [-aria256] [-camellia128]
[-camellia192] [-camellia256] [-des] [-des3] [-idea] [-F4] [-f4] [-3]
[-primes num] [-verbose] [-quiet] [-traditional] [-rand files]
[-writerand file] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq] [numbits]

look at her. so many little flags. so many vibes. 💅

🦋 DESCRIPTION 🦋

bestie, this command generates an RSA private key. that's the tea. 🍵✨

💜 OPTIONS 💜

  • -help — prints a usage message so you know what's up. helpful king. 🫶
  • -out filename — drops the key into the file you name. don't name one? then it goes to standard output, no biggie.
  • -passout arg — this is where the output file password source lives. wanna know the format? go read openssl-passphrase-options(1), she explains everything. 🔐
  • -aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea — these encrypt your private key with the cipher you picked before it gets written out. if you don't pick any of them, no encryption, zero, nada. and if you do use encryption but didn't hand over the pass phrase through -passout, it's gonna prompt you for one. 🙈
  • -F4, -f4, -3 — the public exponent you wanna use, either 65537 or 3. default is 65537. and heads up, the -3 option has been deprecated — it's giving legacy, not giving iconic. 💀
  • -primes num — tells it how many primes to use while generating the RSA key. num has to be a positive integer greater than 1 and less than 16. and if num is greater than 2, congrats, you've made what's called a 'multi-prime' RSA key, which is defined in RFC 8017. very fancy of you. ✨
  • -verbose — prints extra deets about everything that's happening behind the scenes. nosy (affectionate). 👀
  • -quiet — prints fewer deets about what's going on, which lowkey slaps during batch scripts and pipelines. 🤫
  • -traditional — writes the key using the old-school PKCS#1 format instead of the PKCS#8 format. vintage, but make it on purpose. 🎀
  • -rand files, -writerand file — go peep "Random State Options" in openssl(1) for the full rundown.
  • -provider name , -provider-path path , -provparam [name:]key=value , -propquery propq — all the provider tea lives in "Provider Options" in openssl(1), plus provider(7) and property(7). go read those, i promise they eat. 💅
  • numbits — the size of the private key you're generating, in bits. this has to be the last option you specify, periodt. default is 2048, and values less than 512 are not allowed. 🚫

🌈 NOTES 🌈

so RSA private key generation is basically about generating two or more prime numbers. while it's doing that, it spits out little symbols to show you the progress, and you will see them, so let me translate:

  • . — this number passed an initial sieve test, we love that for her 🫶
  • + — this number passed a single round of the Miller-Rabin primality test, slay
  • * — uh oh, the current prime is starting a regenerating progress because some tests failed. it's fine. everything's fine. 😭
  • a newline — the number passed all the prime tests (exactly how many tests depends on the key size though, iykyk)

and bc key generation is a random process, how long it takes may vary a lil bit. but generally speaking: more primes = less generation time for a key. iconic math behavior. ⭐

👑 SEE ALSO 👑

openssl(1), openssl-genpkey(1), openssl-gendsa(1)

📜 HISTORY 📜

the -engine option was removed in OpenSSL 4.0. rest in peace bestie, you were real. 💀🕯️

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, we ATE that 💅✨ this was version 4.0.3, dated 2026-09-29, and yes she's still out here serving under the OPENSSL-GENRSA(1SSL) title. go make some keys, you got this 🫶🌸💖

📦 where this page comes from