openssl genpkey: Modern Private Key Generation

openssl genpkey generates a private key for any supported algorithm with one consistent interface.

genpkey supersedes genrsa and ecparam for new scripts. It always emits PKCS#8 and works the same across RSA, EC, and Ed25519.

What it does

openssl genpkey creates a private key for the algorithm you name with -algorithm, applying any algorithm options via -pkeyopt. Output is PEM PKCS#8 by default.

Common usage

Terminal

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out key.pem
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec.pem
openssl genpkey -algorithm Ed25519 -out ed.pem

Options

Flag	What it does
-algorithm <name>	Key type: RSA, EC, Ed25519, X25519, etc.
-pkeyopt <opt:value>	Algorithm parameter, e.g. rsa_keygen_bits:4096
-out <file>	Write the key to a file
-aes256	Encrypt the output key
-pass pass:<x>	Supply the encryption passphrase non-interactively

Common errors in CI

"Algorithm <X> not found" means the provider for that algorithm is not loaded; on OpenSSL 3.x check that the default provider is active. "ec_paramgen_curve: parameter setting error" usually means a misspelled curve name (use P-256, not prime256v1, here). Entropy/RANDFILE errors are the same as with genrsa: set HOME or RANDFILE to a writable path.

Related guides

openssl genrsa: Generate RSA Private Keys in CIopenssl genrsa generates an RSA private key. Reference for key size, output file, and optional encryption, pl… openssl ecparam: EC Parameters and Key Genopenssl ecparam lists curves and generates EC keys the classic way. Reference for -list_curves, -name, -genke… openssl pkey: Inspect Any Private Keyopenssl pkey is the algorithm-agnostic key tool for RSA, EC, and Ed25519. Reference for -pubout, -text, -chec… openssl req -x509: Self-Signed Certificatesopenssl req -x509 creates a self-signed certificate in one command, ideal for tests. Reference for -newkey, -…