Manual: openssl-genrsa

OPENSSL-GENRSA(1SSL)					   OpenSSL					OPENSSL-GENRSA(1SSL)

NAME
       openssl-genrsa - generate an RSA private key

SYNOPSIS
       openssl genrsa [-help] [-out filename] [-passout arg] [-aes128] [-aes192] [-aes256] [-aria128] [-aria192] [-aria256]
       [-camellia128] [-camellia192] [-camellia256] [-des] [-des3] [-idea] [-F4] [-f4] [-3] [-primes num] [-verbose]
       [-quiet] [-traditional] [-rand files] [-writerand file] [-engine id] [-provider name] [-provider-path path]
       [-provparam [name:]key=value] [-propquery propq] [numbits]

DESCRIPTION
       This command generates an RSA private key.

OPTIONS
       -help
	   Print out a usage message.

       -out filename
	   Output the key to the specified file. If this argument is not specified then standard output is used.

       -passout arg
	   The output file password source. For more information about the format see openssl-passphrase-options(1).

       -aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea
	   These  options  encrypt  the	 private key with specified cipher before outputting it. If none of these options is
	   specified no encryption is used. If encryption is used a pass phrase is prompted for if it is  not  supplied	 via
	   the -passout argument.

       -F4, -f4, -3
	   The public exponent to use, either 65537 or 3. The default is 65537.	 The -3 option has been deprecated.

       -primes num
	   Specify  the	 number	 of primes to use while generating the RSA key. The num parameter must be a positive integer
	   that is greater than 1 and less than 16.  If num  is	 greater  than	2,  then  the  generated  key  is  called  a
	   'multi-prime' RSA key, which is defined in RFC 8017.

       -verbose
	   Print extra details about the operations being performed.

       -quiet
	   Print fewer details about the operations being performed, which may be handy during batch scripts and pipelines.

       -traditional
	   Write the key using the traditional PKCS#1 format instead of the PKCS#8 format.

       -rand files, -writerand file
	   See "Random State Options" in openssl(1) for details.

       -engine id
	   See "Engine Options" in openssl(1).	This option is deprecated.

       -provider name
       -provider-path path
       -provparam [name:]key=value
       -propquery propq
	   See "Provider Options" in openssl(1), provider(7), and property(7).

       numbits
	   The	size of the private key to generate in bits. This must be the last option specified. The default is 2048 and
	   values less than 512 are not allowed.

NOTES
       RSA private key generation essentially involves the generation of two  or  more	prime  numbers.	 When  generating  a
       private	key  various  symbols  will be output to indicate the progress of the generation. A . represents each number
       which has passed an initial sieve test, + means a number has passed a single  round  of	the  Miller-Rabin  primality
       test,  *	 means	the  current prime starts a regenerating progress due to some failed tests. A newline means that the
       number has passed all the prime tests (the actual number depends on the key size).

       Because key generation is a random process the time taken to generate a key may vary somewhat. But in  general,	more
       primes lead to less generation time of a key.

SEE ALSO
       openssl(1), openssl-genpkey(1), openssl-gendsa(1)

COPYRIGHT
       Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

       Licensed	 under	the  Apache  License  2.0  (the "License").  You may not use this file except in compliance with the
       License.	   You	 can   obtain	a   copy   in	the   file   LICENSE   in   the	  source    distribution    or	  at
       .

3.5.5							 2026-01-27					OPENSSL-GENRSA(1SSL)