openssl ecparam: EC Parameters and Key Gen
openssl ecparam shows EC curve parameters and can generate an EC key with -genkey.
Before genpkey existed this was how you made EC keys. It is still the quickest way to list supported curves.
What it does
openssl ecparam manipulates EC parameter sets. -list_curves prints every supported curve; -name selects one; -genkey generates a private key for it. The curve names here are the OpenSSL aliases like prime256v1.
Common usage
openssl ecparam -list_curves
openssl ecparam -name prime256v1 -genkey -noout -out ec.pem
# modern equivalent
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec.pemOptions
| Flag | What it does |
|---|---|
| -list_curves | List supported named curves |
| -name <curve> | Select a curve (e.g. prime256v1, secp384r1) |
| -genkey | Generate a private key for the curve |
| -noout | Suppress the parameter block in output |
In CI
Mind the naming: ecparam uses prime256v1 while genpkey uses P-256 for the same curve. Mixing them up yields "unknown curve" errors. New scripts should prefer genpkey for consistency with the rest of OpenSSL 3.x.
Common errors in CI
"unknown curve name" means a typo or a curve disabled in this build; check openssl ecparam -list_curves. Without -noout the file includes a BEGIN EC PARAMETERS block, which some loaders reject alongside the key; add -noout.