OPENSSL-RSA(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ openssl-rsa ✨

okay bestie, welcome to the openssl-rsa manual page (she lives in section 1SSL of the OpenSSL docs, iykyk) — this is the RSA key processing command and she is literally the moment 💅

🌸 NAME 🌸

openssl-rsa — the RSA key processing command, aka your girl who handles RSA keys and does it flawlessly 👑

🎀 SYNOPSIS 🎀

openssl rsa [-help] [-inform DER|PEM|P12] [-outform DER|PEM] [-in
filename|uri] [-passin arg] [-out filename] [-passout arg] [-aes128]
[-aes192] [-aes256] [-aria128] [-aria192] [-aria256] [-camellia128]
[-camellia192] [-camellia256] [-des] [-des3] [-idea] [-text] [-noout]
[-modulus] [-traditional] [-check] [-pubin] [-pubout] [-RSAPublicKey_in]
[-RSAPublicKey_out] [-pvk-strong] [-pvk-weak] [-pvk-none] [-provider
name] [-provider-path path] [-provparam [name:]key=value] [-propquery
propq]

like yes, that's a lot of flags, but every single one of them is serving a purpose, no cap 🫶

🦋 DESCRIPTION 🦋

So here's the vibe: this command processes RSA keys. She can convert them between all sorts of different forms, and she can print their components out for you. That's the whole gig and she does it beautifully ✨

💅 OPTIONS 💅

okay here we go, the full rundown, no skips, no summarising, every single one is getting her moment 🌟

  • -help — prints out a usage message. the "bestie what do i type" button, love her.
  • -inform DER|PEM|P12 — this is the key input format, and it's unspecified by default. peep openssl-format-options(1) for the deets 📖
  • -outform DER|PEM — the key output format, and the default here is PEM. again, openssl-format-options(1) has the tea.
  • -traditional — when you're writing a private key, this makes her use the traditional PKCS#1 format instead of the PKCS#8 format. old school, but make it fashion 💁‍♀️
  • -in filename|uri — tells her where to read a key from. if you don't give her this option, she reads from standard input. and if the key happens to be encrypted, she's gonna prompt you for a pass phrase 🔐
  • -passin arg, -passout arg — the password source for the input file and the output file respectively. wanna know what format arg should be in? openssl-passphrase-options(1) is your girl.
  • -out filename — where to write the key. no option means she writes to standard output. if you've set any encryption options, she'll prompt you for a pass phrase. also, fr fr: the output filename should not be the same as the input filename 🚨
  • -aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea — all of these encrypt the private key with the specified cipher before she outputs it, and a pass phrase gets prompted for. if you don't pick any of them, the key is written in plain text 😭 which means: this command can strip the pass phrase off a key (just don't give any encryption option), or add/change the pass phrase (give one). big important caveat bestie — these options can only be used with PEM format output files, periodt.
  • -text — prints out the various public or private key components in plain text, on top of the encoded version. a little bonus look inside 👀
  • -noout — stops her from outputting the encoded version of the key. so you get the vibes without the blob.
  • -modulus — prints out the value of the modulus of the key. just the modulus, as a treat 🍓
  • -check — checks the consistency of an RSA private key. a little health check, we love a self-care moment 🩺
  • -pubin — by default she reads a private key from the input; with this, she reads a public key instead. and if the input has no public key but does have a private key, she just uses its public part. adaptive queen 💅
  • -pubout — by default she outputs a private key; with this, a public key gets output instead. this one gets set automatically if the input is a public key, she's got it handled ✨
  • -RSAPublicKey_in, -RSAPublicKey_out — same energy as -pubin and -pubout, except the RSAPublicKey format is what's used instead.
  • -pvk-strong — enables the 'Strong' PVK encoding level. and this is the default, so she's already on it 💪
  • -pvk-weak — enables the 'Weak' PVK encoding level. choose wisely bestie.
  • -pvk-none — doesn't enforce PVK encoding at all. free spirit 🌈
  • -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — hit up "Provider Options" inside openssl(1), plus provider(7) and property(7), for all the info you could ever want 📚

👑 NOTES 👑

little heads up: the openssl-pkey(1) command can do everything this command can do, and she supports other public key types too. so like... she's a bit of an overachiever. both are iconic, just know your options 🫶

🌈 EXAMPLES 🌈

the docs for openssl-pkey(1) have examples that are equivalent to the ones listed here. but here they are anyway because we're thorough 💖

to remove the pass phrase on an RSA private key:

openssl rsa -in key.pem -out keyout.pem

to encrypt a private key using triple DES:

openssl rsa -in key.pem -des3 -out keyout.pem

to convert a private key from PEM to DER format:

openssl rsa -in key.pem -outform DER -out keyout.der

to print out the components of a private key to standard output:

openssl rsa -in key.pem -text -noout

to just output the public part of a private key:

openssl rsa -in key.pem -pubout -out pubkey.pem

output the public part of a private key in RSAPublicKey format:

openssl rsa -in key.pem -RSAPublicKey_out -out pubkey.pem

😭 BUGS 😭

not me telling you this: there should be an option that automatically handles .key files, without you having to manually edit them. currently there is not. we suffer 🥲

💜 SEE ALSO 💜

openssl(1), openssl-pkey(1), openssl-pkcs8(1), openssl-dsa(1), openssl-genrsa(1), openssl-gendsa(1)

🧚 HISTORY 🧚

the -engine option was removed in OpenSSL 4.0. she's gone, bestie, rest in peace 🕊️

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, you ate that 💅 this was OPENSSL-RSA(1SSL) from OpenSSL 4.0.3, dated 2026-09-29 — tysm for reading, go forth and process those keys, mwah 🎀💖✨

📦 where this page comes from