OpenSSL • Generation & Keys
How to Generate a Secure RSA Private Key (2048 or 4096 bit)
`openssl genrsa` creates a standard PKCS#1 RSA private key. The resulting key can be paired with certificate signing requests, used as signing keys for JSON Web Tokens (JWT RS256), or deployed to TLS terminators.
Generate RSA Private Key Command
Safe • Read-Only / File Generation
openssl genrsa -out private.key 4096Customize:
Domain:
Cert File:
OpenSSL Flags & Options Explained
-out private.keyDestination path for generated private key4096Modulus size in bits (2048 or 4096 recommended)-aes256Optional: Encrypt the key with AES-256 and prompt for a passphraseExecution Steps & Verification
1Generate 4096-bit RSA key
Create the key without a passphrase:
openssl genrsa -out private.key 40962Protect key file permissions
Lock down read access to current user only:
chmod 600 private.key3Extract corresponding public key
Generate the matching public key for sharing:
openssl rsa -in private.key -pubout -out public.keyCommon Security Pitfalls & Solutions
- Never commit private.key to Git! Add `*.key` and `*.pem` to your `.gitignore`.
- For modern high-performance cryptography with smaller keys, consider Ed25519 or ECDSA P-256: `openssl ecparam -name prime256v1 -genkey -noout -out ec-private.key`.
Prerequisites & Environment
- Local terminal with OpenSSL.
Frequently Asked Questions About Generate RSA Private Key
Frequently Asked Questions
Frequently Asked Questions
Everything you need to know regarding specifications, syntax, and security best practices.
On modern CPUs, generating a 4096-bit RSA key takes between 0.1 and 0.5 seconds.
Related OpenSSL & Security Commands
View All RecipesGeneration & Keys
How to Generate a Self-Signed SSL Certificate with OpenSSL
reqGuide →
Verification & Inspection
How to Check SSL Certificate Expiration Date from Domain or File
s_clientGuide →
Verification & Inspection
How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)
x509Guide →
Verification & Inspection
How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)
x509Guide →
Generation & Keys
How to Generate a Certificate Signing Request (CSR) with SAN
reqGuide →
Format Conversions
How to Convert PFX / PKCS#12 to PEM Certificate and Private Key
pkcs12Guide →