OPENSSL-SKEYUTL(1SSL)

💖 OPENSSL-SKEYUTL 💖

okay bestie, this is the openssl-skeyutl page from the OpenSSL manual — the whole vibe is opaque symmetric keys routines and honestly? it's giving key-management main character energy 👑

---

✨ NAME ✨

openssl-skeyutl — opaque symmetric keys routines 🔐🦋

---

🎀 SYNOPSIS 🎀

openssl skeyutl [-help] [-cipher cipher] [-skeymgmt skeymgmt] [-skeyopt
opt:value] [-genkey] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq]

no cap, that's the whole shape of it 💅

---

🌸 DESCRIPTION 🌸

So here's the tea: not all cipher implementations support keys as raw bytes. like, not every cipher wants to show you its whole self 😭

For example, PKCS#11 tokens can store keys internally and there's just… no option to get the raw byte representation. it's private, it's mysterious, it's keeping its secrets 🫶

This tool is designed for managing opaque symmetric keys. periodt. that's the job, that's the gig 💖

---

👑 OPTIONS 👑

• -help — print out a usage message. your lil helpful bestie, always there 🥰
• -cipher cipher — the cipher to generate the key for. pick your cipher, bestie 🔥
• -skeymgmt skeymgmt — so some providers may support opaque symmetric keys objects, and to use them we need to know the skeymgmt. if you don't specify it, the name of the cipher will be used instead — auto-fill, slay ✨

To find out the name of the suitable symmetric key management, please refer to the output of the "openssl list -skey-managers" command. that command is your bestie, go ask it 🦋

• -skeyopt opt:value — to obtain an existing opaque symmetric key or to generate a new one, key options are specified as opt:value. important though: these options can't be used together with any options implying raw key, either directly or indirectly. not even a little. do not mix them, i'm serious 🚫💀
• -genkey — generate a new opaque key object. fresh key, brand new, glowing 🌟
• -provider name
• -provider-path path
• -provparam [name:]key=value
• -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). go read those if you want the full provider lore 📚💜

---

🦋 SEE ALSO 🦋

openssl-enc(1), EVP_SKEY(3)

friends of the family, go say hi 💞

---

⭐ HISTORY ⭐

The skeyutl command was added in OpenSSL 3.5. new-ish era, iconic behavior 👑

---

💌 COPYRIGHT 💌

Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie!!

this vibe check was brought to you by OpenSSL 4.0.3, dated 2026-09-29 🌈✨ mwah, go read your keys 💅💖