How to generate a private key using OpenSSL

A private key is the secret half of a certificate or signing key pair, and every later certificate request or public key depends on the exact file created here. Generating it in a restricted directory with the intended algorithm and size prevents accidental exposure before the key reaches a CSR, certificate, or service configuration.

The openssl genpkey command writes private keys through OpenSSL's generic public-key interface. A 3072-bit RSA key remains a common choice for TLS server CSRs and certificate deployment; choose a different key type only when the issuer or application profile requires it.

Unencrypted service keys rely on filesystem permissions so daemons can read them at startup without a passphrase prompt. Use passphrase protection for keys that will be transferred, archived, or unlocked by a person, and keep the passphrase outside shell history, tickets, and the directory that holds public certificate files.

1. Create a private directory for the key material.

   $ install -m 700 -d ~/tls-keys

2. Set a restrictive file-creation mask for the current shell.

   $ umask 077

   Files created after this command are not readable by group or other users unless a later command changes the mode explicitly.

3. Generate an unencrypted RSA private key.

   $ openssl genpkey -quiet -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out ~/tls-keys/server.key

   -quiet suppresses RSA generation progress characters. Keep rsa_keygen_bits:3072 unless policy or the receiving system requires another size.

4. Check the private key file permissions.

   $ ls -l ~/tls-keys/server.key
   -rw------- 1 user user 2484 Jun 30 08:04 /home/user/tls-keys/server.key

   If group or other users can read the key, restrict it before using it in a certificate request or service configuration.

5. Verify that OpenSSL can parse and validate the private key.

   $ openssl pkey -in ~/tls-keys/server.key -check -noout
   Key is valid