info > openssl-rsa(1)

man perldoc info pydoc3 ri search

📝 NAME

openssl-rsa - RSA key processing command

🚀 Quick Reference

Use Case	Command	Description
Remove pass phrase from key	openssl rsa -in key.pem -out keyout.pem	Decrypts and writes key without encryption
Encrypt private key with triple DES	openssl rsa -in key.pem -des3 -out keyout.pem	Adds passphrase protection
Convert PEM to DER format	openssl rsa -in key.pem -outform DER -out keyout.der	Changes output encoding
Print key components (text only)	openssl rsa -in key.pem -text -noout	Displays modulus, exponents, etc.
Output public key from private key	openssl rsa -in key.pem -pubout -out pubkey.pem	Extracts public part
Output public key in RSAPublicKey format	openssl rsa -in key.pem -RSAPublicKey_out -out pubkey.pem	Uses legacy format

📖 SYNOPSIS

openssl rsa [-help] [-inform DER|PEM|P12|ENGINE] [-outform DER|PEM]
       [-in filename|uri] [-passin arg] [-out filename] [-passout arg]
       [-aes128] [-aes192] [-aes256] [-aria128] [-aria192] [-aria256]
       [-camellia128] [-camellia192] [-camellia256] [-des] [-des3] [-idea]
       [-text] [-noout] [-modulus] [-traditional] [-check] [-pubin] [-pubout]
       [-RSAPublicKey_in] [-RSAPublicKey_out] [-pvk-strong] [-pvk-weak]
       [-pvk-none] [-engine id] [-provider name] [-provider-path path]
       [-propquery propq]

📝 DESCRIPTION

This command processes RSA keys. They can be converted between various forms and their components printed out.

⚙️ OPTIONS

• -help ℹ️ Print out a usage message.
• -inform DER|PEM|P12|ENGINE 📥 The key input format; unspecified by default. See openssl-format-options(1).
• -outform DER|PEM 📤 The key output format; default is PEM. See openssl-format-options(1).
• -traditional 📜 When writing a private key, use traditional PKCS#1 format instead of PKCS#8.
• -in filename|uri 📂 Input key file (or stdin if omitted). Prompts for pass phrase if encrypted.
• -passin arg, -passout arg 🔑 Password sources for input and output. See openssl-passphrase-options(1).
• -out filename 📄 Output filename (stdout if omitted). Prompts for pass phrase if encryption options set.
• -aes128, -aes192, -aes256, -aria128, -aria192, -aria256, -camellia128, -camellia192, -camellia256, -des, -des3, -idea 🔒 Encrypt private key with specified cipher before output. Prompts for pass phrase. If none given, key is written plain text (can remove/add/change pass phrase). Only for PEM output.
• -text 👁️ Print key components in plain text alongside encoded version.
• -noout 🚫 Suppress output of encoded key.
• -modulus 🔢 Print the modulus value of the key.
• -check ✅ Check consistency of an RSA private key.
• -pubin 📖 Read public key instead of private key.
• -pubout 📤 Output public key instead of private key. Automatically set if input is public key.
• -RSAPublicKey_in, -RSAPublicKey_out 🔄 Like -pubin/-pubout but using RSAPublicKey format.
• -pvk-strong 💪 Enable 'Strong' PVK encoding level (default).
• -pvk-weak 🟡 Enable 'Weak' PVK encoding level.
• -pvk-none 🚫 Don't enforce PVK encoding.
• -engine id ⚙️ Deprecated See "Engine Options" in openssl(1).
• -provider name, -provider-path path, -propquery propq 🧩 See "Provider Options" in openssl(1), provider(7), and property(7).

📌 NOTES

The openssl-pkey(1) command is capable of performing all the operations this command can, as well as supporting other public key types.

💡 EXAMPLES

The documentation for the openssl-pkey(1) command contains examples equivalent to the ones listed here.

Remove the pass phrase on an RSA private key:

openssl rsa -in key.pem -out keyout.pem

Encrypt a private key using triple DES:

openssl rsa -in key.pem -des3 -out keyout.pem

Convert a private key from PEM to DER format:

openssl rsa -in key.pem -outform DER -out keyout.der

Print out the components of a private key to standard output:

openssl rsa -in key.pem -text -noout

Just output the public part of a private key:

openssl rsa -in key.pem -pubout -out pubkey.pem

Output the public part of a private key in RSAPublicKey format:

openssl rsa -in key.pem -RSAPublicKey_out -out pubkey.pem

🐛 BUGS

There should be an option that automatically handles .key files, without having to manually edit them.

📚 SEE ALSO

openssl(1), openssl-pkey(1), openssl-pkcs8(1), openssl-dsa(1), openssl-genrsa(1), openssl-gendsa(1)

📜 HISTORY

The -engine option was deprecated in OpenSSL 3.0.

©️ COPYRIGHT

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

📝 NAME 🚀 Quick Reference 📖 SYNOPSIS 📝 DESCRIPTION ⚙️ OPTIONS 📌 NOTES 💡 EXAMPLES 🐛 BUGS 📚 SEE ALSO 📜 HISTORY ©️ COPYRIGHT