How to generate an openSSL key using a passphrase from the command line?

by

If you don’t use a passphrase, then the private key is not encrypted with any symmetric cipher – it is output completely unprotected.

You can generate a keypair, supplying the password on the command-line using an invocation like (in this case, the password is foobar):

openssl genrsa -aes128 -passout pass:foobar 3072

However, note that this passphrase could be grabbed by any other process running on the machine at the time, since command-line arguments are generally visible to all processes.

A better alternative is to write the passphrase into a temporary file that is protected with file permissions, and specify that:

openssl genrsa -aes128 -passout file:passphrase.txt 3072

Or supply the passphrase on standard input:

openssl genrsa -aes128 -passout stdin 3072

You can also used a named pipe with the file: option, or a file descriptor.

To then obtain the matching public key, you need to use openssl rsa, supplying the same passphrase with the -passin parameter as was used to encrypt the private key:

openssl rsa -passin file:passphrase.txt -pubout

(This expects the encrypted private key on standard input – you can instead read it from a file using -in <file>).

Example of creating a 3072-bit private and public key pair in files, with the private key pair encrypted with password foobar:

openssl genrsa -aes128 -passout pass:foobar -out privkey.pem 3072
openssl rsa -in privkey.pem -passin pass:foobar -pubout -out privkey.pub

More Related Contents:

  1. How can I transform between the two styles of public key format, one “BEGIN RSA PUBLIC KEY”, the other is “BEGIN PUBLIC KEY”
  2. Differences between “BEGIN RSA PRIVATE KEY” and “BEGIN PRIVATE KEY”
  3. Converting pfx to pem using openssl
  4. CMake not able to find OpenSSL library
  5. Use RSA private key to generate public key? [closed]
  6. Converting PKCS#12 certificate into PEM using OpenSSL
  7. Difference between openSSL rsautl and dgst
  8. Verify a certificate chain using openssl verify
  9. Convert PEM traditional private key to PKCS8 private key
  10. Using OpenSSL what does “unable to write ‘random state'” mean?
  11. Multiple OpenSSL RSA signing methods produce different results
  12. How to extract public key using OpenSSL?
  13. OpenSSL Verify return code: 20 (unable to get local issuer certificate)
  14. How do I manage the error “OpenSSL v1.1.1 ssl_choose_client_version unsupported protocol”? [closed]
  15. Why is Apple Deprecating OpenSSL in MacOS 10.7 (Lion)? [closed]
  16. RSA: Get exponent and modulus given a public key
  17. Correct location of openssl.cnf file
  18. Programmatically Create X509 Certificate using OpenSSL
  19. Convert pem key to ssh-rsa format
  20. How to save public key from a certificate in .pem format
  21. How to create public and private key with openssl?
  22. How to convert an ECDSA key to PEM format
  23. Unable to load Private Key. (PEM routines:PEM_read_bio:no start line:pem_lib.c:648:Expecting: ANY PRIVATE KEY) [closed]
  24. Creating a .p12 file
  25. How do I get Visual Studio Code to trust our self-signed proxy certificate?
  26. When was TLS 1.2 support added to OpenSSL?
  27. Cross Compile OpenSSH for ARM
  28. How to make browser trust localhost SSL certificate? [closed]
  29. mcrypt_encrypt to openssl_encrypt, and OPENSSL_ZERO_PADDING problems
  30. OpenSSL DH Key Too Small Error

Leave a Comment