OpenSSL Key Generation Guide - RSA & ECC Private Keys

Quick Answer: Generate a Private Key

The fastest way to generate a private key with OpenSSL:

# Generate 2048-bit RSA key (most compatible)
openssl genrsa -out private.key 2048

# Generate ECDSA key with P-256 curve (modern, faster)
openssl ecparam -genkey -name prime256v1 -out private.key

# Generate Ed25519 key (newest, best performance)
openssl genpkey -algorithm Ed25519 -out private.key

💡 Recommendation: Use RSA 2048 for maximum compatibility, ECDSA P-256 for modern systems, or Ed25519 for cutting-edge security with best performance.

RSA vs ECDSA vs Ed25519

OpenSSL supports multiple key algorithms. Here's how they compare:

Algorithm	Key Size	Security	Performance	Compatibility
RSA	2048-4096 bits	✅ Proven	⚠️ Slower	✅ Universal
ECDSA P-256	256 bits	✅ Strong	✅ Fast	✅ Modern
ECDSA P-384	384 bits	✅ Very Strong	✅ Fast	✅ Good
Ed25519	256 bits	✅ Excellent	✅ Fastest	⚠️ Newer systems

RSA

The classic choice. Use 2048 bits minimum, 4096 for long-term security. Works everywhere.

ECDSA

Modern elliptic curve. P-256 offers RSA-3072 security with much smaller keys.

Ed25519

Latest standard. Best performance, no weak parameter choices, fixed key size.

Generating RSA Keys

RSA is the most widely supported algorithm. Use genrsa or the newer genpkey command.

Basic RSA Key Generation

# Generate 2048-bit RSA key (minimum recommended)
openssl genrsa -out private.key 2048

# Generate 4096-bit RSA key (stronger, slower)
openssl genrsa -out private.key 4096

RSA Key with Password Protection

# Generate encrypted RSA key (will prompt for password)
openssl genrsa -aes256 -out private.key 2048

# Verify key is encrypted (should show "ENCRYPTED")
head -1 private.key
# -----BEGIN ENCRYPTED PRIVATE KEY-----

Using genpkey (Modern Method)

# Generate RSA key using genpkey (recommended)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.key

# With encryption
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
  -aes-256-cbc -out private.key

Note: The genpkey command is the modern replacement forgenrsa. It supports all algorithms uniformly and is recommended for new scripts.

Generating ECDSA Keys

ECDSA keys offer equivalent security to RSA with much smaller key sizes. The most common curves are P-256 (prime256v1) and P-384 (secp384r1).

Using ecparam (Traditional Method)

# Generate ECDSA key with P-256 curve
openssl ecparam -genkey -name prime256v1 -out private.key

# Generate with P-384 curve (stronger)
openssl ecparam -genkey -name secp384r1 -out private.key

# List all available curves
openssl ecparam -list_curves

Using genpkey (Modern Method)

# Generate ECDSA P-256 key using genpkey
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out private.key

# Generate ECDSA P-384 key
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 -out private.key

# With encryption
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \
  -aes-256-cbc -out private.key

Common ECDSA Curves

Curve Name	Alternative Names	Security Level	Use Case
prime256v1	P-256, secp256r1	128-bit	TLS, web servers
secp384r1	P-384	192-bit	Government, high security
secp521r1	P-521	256-bit	Maximum security

Generating Ed25519 Keys

Ed25519 is a modern elliptic curve algorithm with excellent security and performance. It uses a fixed 256-bit key size and is resistant to timing attacks.

Generate Ed25519 Key

# Generate Ed25519 private key
openssl genpkey -algorithm Ed25519 -out private.key

# Generate with encryption
openssl genpkey -algorithm Ed25519 -aes-256-cbc -out private.key

Ed448 (Stronger Variant)

# Generate Ed448 private key (448-bit, even stronger)
openssl genpkey -algorithm Ed448 -out private.key

⚠️ Compatibility Note: Ed25519 requires OpenSSL 1.1.1+ and may not be supported by older servers, browsers, or applications. Test compatibility before deploying.

Encrypting Private Keys

Private keys should be encrypted with a passphrase to protect them if the file is compromised.

Encrypt an Existing Key

# Encrypt an unencrypted private key
openssl rsa -aes256 -in private.key -out private_encrypted.key

# For ECDSA keys
openssl ec -aes256 -in private.key -out private_encrypted.key

# For any key type (using pkey)
openssl pkey -aes256 -in private.key -out private_encrypted.key

Remove Encryption (Decrypt)

# Remove passphrase from RSA key
openssl rsa -in private_encrypted.key -out private.key

# Remove passphrase from ECDSA key
openssl ec -in private_encrypted.key -out private.key

# Generic method (any key type)
openssl pkey -in private_encrypted.key -out private.key

Encryption Algorithms

Option	Algorithm	Recommendation
-aes256	AES-256-CBC	✅ Recommended
-aes-256-cbc	AES-256-CBC (explicit)	✅ Recommended
-aes128	AES-128-CBC	⚠️ Acceptable
-des3	Triple DES	❌ Legacy only

Security Warning: Never store unencrypted private keys in version control, shared directories, or backups. Use encrypted keys or a secrets manager.

Inspecting Generated Keys

After generating a key, verify its properties and extract the public key.

View Key Details

# View RSA key details
openssl rsa -in private.key -text -noout

# View ECDSA key details
openssl ec -in private.key -text -noout

# View any key type (generic)
openssl pkey -in private.key -text -noout

Extract Public Key

# Extract public key from RSA private key
openssl rsa -in private.key -pubout -out public.key

# Extract from ECDSA key
openssl ec -in private.key -pubout -out public.key

# Generic method (any key type)
openssl pkey -in private.key -pubout -out public.key

Check Key File Format

# Check if key is encrypted
head -1 private.key
# -----BEGIN ENCRYPTED PRIVATE KEY----- (encrypted)
# -----BEGIN PRIVATE KEY----- (PKCS#8, unencrypted)
# -----BEGIN RSA PRIVATE KEY----- (traditional, unencrypted)
# -----BEGIN EC PRIVATE KEY----- (EC traditional, unencrypted)

# Verify key is valid
openssl pkey -in private.key -check

Troubleshooting Common Errors

unable to load Private Key

unable to load Private Key

Causes:

• Wrong passphrase for encrypted key
• Corrupted key file
• Wrong file format (e.g., certificate instead of key)

Solution: Check file header with head -1 private.key and verify it's actually a private key file.

Algorithm not supported

Error: Algorithm Ed25519 not supported

Cause: Your OpenSSL version is too old.

# Check OpenSSL version
openssl version
# Ed25519 requires OpenSSL 1.1.1 or later

unknown curve name

unknown curve name (prime256v1)

Solution: Try alternative curve names:

# List available curves
openssl ecparam -list_curves | grep -i 256

# Try different names for P-256
openssl ecparam -genkey -name P-256 -out key.pem
openssl ecparam -genkey -name secp256r1 -out key.pem

Permission denied

Error: unable to write 'private.key'

Solution: Check directory permissions or specify a different output path. Private keys should be created with 600 permissions.

# Create key with proper permissions
umask 077
openssl genrsa -out private.key 2048

# Or fix after creation
chmod 600 private.key

Best Practices Checklist

Use RSA 2048 minimum, 4096 for long-term security
Prefer ECDSA P-256 or Ed25519 for new deployments
Always encrypt private keys with AES-256
Set file permissions to 600 (owner read/write only)
Never commit private keys to version control
Store keys in a secrets manager for production
Rotate keys when employees leave or breaches occur
Use genpkey instead of genrsa for new scripts

Frequently Asked Questions

Should I use RSA or ECDSA for SSL certificates?

For new deployments, use ECDSA P-256. It offers equivalent security to RSA-3072 with smaller keys and faster performance. Use RSA 2048 if you need compatibility with older systems.

What RSA key size should I use?

2048 bits is the minimum for certificates valid today. Use 4096 bits for keys that will be used beyond 2030 or for high-security applications.

Should I encrypt my private key with a passphrase?

Yes, always encrypt private keys in production. Use -aes256 encryption. For automated systems, use a secrets manager instead of storing passphrases in scripts.

What is the difference between genrsa and genpkey?

genpkey is the modern, unified command that works with all algorithms (RSA, EC, Ed25519). genrsa is the legacy command for RSA only. Use genpkey for new scripts.

Can I convert between key formats?

Yes. Use openssl pkey to convert between formats. For example, traditional RSA format to PKCS#8: openssl pkey -in traditional.key -out pkcs8.key

How do I generate a key and CSR in one command?

Use: openssl req -newkey rsa:2048 -keyout private.key -out request.csr. This generates both the private key and certificate signing request together.

OpenSSL Generate Private Key: Complete Guide

Quick Answer: Generate a Private Key

RSA vs ECDSA vs Ed25519

RSA

ECDSA

Ed25519

Generating RSA Keys

Basic RSA Key Generation

RSA Key with Password Protection

Using genpkey (Modern Method)

Generating ECDSA Keys

Using ecparam (Traditional Method)

Using genpkey (Modern Method)

Common ECDSA Curves

Generating Ed25519 Keys

Generate Ed25519 Key

Ed448 (Stronger Variant)

Encrypting Private Keys

Encrypt an Existing Key

Remove Encryption (Decrypt)

Encryption Algorithms

Inspecting Generated Keys

View Key Details

Extract Public Key

Check Key File Format

Troubleshooting Common Errors

unable to load Private Key

Algorithm not supported

unknown curve name

Permission denied

Best Practices Checklist

Frequently Asked Questions

Should I use RSA or ECDSA for SSL certificates?

What RSA key size should I use?

Should I encrypt my private key with a passphrase?

What is the difference between genrsa and genpkey?

Can I convert between key formats?

How do I generate a key and CSR in one command?

Related Resources

OpenSSL CSR Creation

RSA vs ECC Comparison

Encryption Basics

Certificate File Formats

Inspect Certificates