Home | History | Annotate | Line # | Download | only in man1 
      1 =pod
      2 
      3 =head1 NAME
      4 
      5 openssl-pkey,
      6 pkey - public or private key processing tool
      7 
      8 =head1 SYNOPSIS
      9 
     10 B<openssl> B<pkey>
     11 [B<-help>]
     12 [B<-inform PEM|DER>]
     13 [B<-outform PEM|DER>]
     14 [B<-in filename>]
     15 [B<-passin arg>]
     16 [B<-out filename>]
     17 [B<-passout arg>]
     18 [B<-traditional>]
     19 [B<-I<cipher>>]
     20 [B<-text>]
     21 [B<-text_pub>]
     22 [B<-noout>]
     23 [B<-pubin>]
     24 [B<-pubout>]
     25 [B<-engine id>]
     26 [B<-check>]
     27 [B<-pubcheck>]
     28 
     29 =head1 DESCRIPTION
     30 
     31 The B<pkey> command processes public or private keys. They can be converted
     32 between various forms and their components printed out.
     33 
     34 =head1 OPTIONS
     35 
     36 =over 4
     37 
     38 =item B<-help>
     39 
     40 Print out a usage message.
     41 
     42 =item B<-inform DER|PEM>
     43 
     44 This specifies the input format DER or PEM. The default format is PEM.
     45 
     46 =item B<-outform DER|PEM>
     47 
     48 This specifies the output format, the options have the same meaning and default
     49 as the B<-inform> option.
     50 
     51 =item B<-in filename>
     52 
     53 This specifies the input filename to read a key from or standard input if this
     54 option is not specified. If the key is encrypted a pass phrase will be
     55 prompted for.
     56 
     57 =item B<-passin arg>
     58 
     59 The input file password source. For more information about the format of B<arg>
     60 see L<openssl(1)/Pass Phrase Options>.
     61 
     62 =item B<-out filename>
     63 
     64 This specifies the output filename to write a key to or standard output if this
     65 option is not specified. If any encryption options are set then a pass phrase
     66 will be prompted for. The output filename should B<not> be the same as the input
     67 filename.
     68 
     69 =item B<-passout password>
     70 
     71 The output file password source. For more information about the format of B<arg>
     72 see L<openssl(1)/Pass Phrase Options>.
     73 
     74 =item B<-traditional>
     75 
     76 Normally a private key is written using standard format: this is PKCS#8 form
     77 with the appropriate encryption algorithm (if any). If the B<-traditional>
     78 option is specified then the older "traditional" format is used instead.
     79 
     80 =item B<-I<cipher>>
     81 
     82 These options encrypt the private key with the supplied cipher. Any algorithm
     83 name accepted by EVP_get_cipherbyname() is acceptable such as B<des3>.
     84 
     85 =item B<-text>
     86 
     87 Prints out the various public or private key components in
     88 plain text in addition to the encoded version.
     89 
     90 =item B<-text_pub>
     91 
     92 Print out only public key components even if a private key is being processed.
     93 
     94 =item B<-noout>
     95 
     96 Do not output the encoded version of the key.
     97 
     98 =item B<-pubin>
     99 
    100 By default a private key is read from the input file: with this
    101 option a public key is read instead.
    102 
    103 =item B<-pubout>
    104 
    105 By default a private key is output: with this option a public
    106 key will be output instead. This option is automatically set if
    107 the input is a public key.
    108 
    109 =item B<-engine id>
    110 
    111 Specifying an engine (by its unique B<id> string) will cause B<pkey>
    112 to attempt to obtain a functional reference to the specified engine,
    113 thus initialising it if needed. The engine will then be set as the default
    114 for all available algorithms.
    115 
    116 =item B<-check>
    117 
    118 This option checks the consistency of a key pair for both public and private
    119 components.
    120 
    121 =item B<-pubcheck>
    122 
    123 This option checks the correctness of either a public key or the public component
    124 of a key pair.
    125 
    126 =back
    127 
    128 =head1 EXAMPLES
    129 
    130 To remove the pass phrase on an RSA private key:
    131 
    132  openssl pkey -in key.pem -out keyout.pem
    133 
    134 To encrypt a private key using triple DES:
    135 
    136  openssl pkey -in key.pem -des3 -out keyout.pem
    137 
    138 To convert a private key from PEM to DER format:
    139 
    140  openssl pkey -in key.pem -outform DER -out keyout.der
    141 
    142 To print out the components of a private key to standard output:
    143 
    144  openssl pkey -in key.pem -text -noout
    145 
    146 To print out the public components of a private key to standard output:
    147 
    148  openssl pkey -in key.pem -text_pub -noout
    149 
    150 To just output the public part of a private key:
    151 
    152  openssl pkey -in key.pem -pubout -out pubkey.pem
    153 
    154 =head1 SEE ALSO
    155 
    156 L<genpkey(1)>, L<rsa(1)>, L<pkcs8(1)>,
    157 L<dsa(1)>, L<genrsa(1)>, L<gendsa(1)>
    158 
    159 =head1 COPYRIGHT
    160 
    161 Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
    162 
    163 Licensed under the OpenSSL license (the "License").  You may not use
    164 this file except in compliance with the License.  You can obtain a copy
    165 in the file LICENSE in the source distribution or at
    166 L<https://www.openssl.org/source/license.html>.
    167 
    168 =cut
    169