1=pod
2
3=begin comment
4{- join("\n", @autowarntext) -}
5
6=end comment
7
8=head1 NAME
9
10openssl-pkey - public or private key processing command
11
12=head1 SYNOPSIS
13
14B<openssl> B<pkey>
15[B<-help>]
16{- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_provider_synopsis -}
17[B<-check>]
18[B<-pubcheck>]
19[B<-in> I<filename>|I<uri>]
20[B<-inform> B<DER>|B<PEM>|B<P12>|B<ENGINE>]
21[B<-passin> I<arg>]
22[B<-pubin>]
23[B<-out> I<filename>]
24[B<-outform> B<DER>|B<PEM>]
25[B<-I<cipher>>]
26[B<-passout> I<arg>]
27[B<-traditional>]
28[B<-pubout>]
29[B<-noout>]
30[B<-text>]
31[B<-text_pub>]
32[B<-ec_conv_form> I<arg>]
33[B<-ec_param_enc> I<arg>]
34
35=head1 DESCRIPTION
36
37This command processes public or private keys. They can be
38converted between various forms and their components printed.
39
40=head1 OPTIONS
41
42=head2 General options
43
44=over 4
45
46=item B<-help>
47
48Print out a usage message.
49
50{- $OpenSSL::safe::opt_engine_item -}
51
52{- $OpenSSL::safe::opt_provider_item -}
53
54=item B<-check>
55
56This option checks the consistency of a key pair for both public and private
57components.
58
59=item B<-pubcheck>
60
61This option checks the correctness of either a public key
62or the public component of a key pair.
63
64=back
65
66=head2 Input options
67
68=over 4
69
70=item B<-in> I<filename>|I<uri>
71
72This specifies the input to read a key from
73or standard input if this option is not specified.
74If the key input is encrypted and B<-passin> is not given
75a pass phrase will be prompted for.
76
77=item B<-inform> B<DER>|B<PEM>|B<P12>|B<ENGINE>
78
79The key input format; unspecified by default.
80See L<openssl-format-options(1)> for details.
81
82=item B<-passin> I<arg>
83
84The password source for the key input.
85
86For more information about the format of B<arg>
87see L<openssl-passphrase-options(1)>.
88
89=item B<-pubin>
90
91By default a private key is read from the input.
92With this option only the public components are read.
93
94=back
95
96=head2 Output options
97
98=over 4
99
100=item B<-out> I<filename>
101
102This specifies the output filename to save the encoded and/or text output of key
103or standard output if this option is not specified.
104If any cipher option is set but no B<-passout> is given
105then a pass phrase will be prompted for.
106The output filename should B<not> be the same as the input filename.
107
108=item B<-outform> B<DER>|B<PEM>
109
110The key output format; the default is B<PEM>.
111See L<openssl-format-options(1)> for details.
112
113=item B<-I<cipher>>
114
115Encrypt the PEM encoded private key with the supplied cipher. Any algorithm
116name accepted by EVP_get_cipherbyname() is acceptable such as B<aes128>.
117Encryption is not supported for DER output.
118
119=item B<-passout> I<arg>
120
121The password source for the output file.
122
123For more information about the format of B<arg>
124see L<openssl-passphrase-options(1)>.
125
126=item B<-traditional>
127
128Normally a private key is written using standard format: this is PKCS#8 form
129with the appropriate encryption algorithm (if any). If the B<-traditional>
130option is specified then the older "traditional" format is used instead.
131
132=item B<-pubout>
133
134By default the private and public key is output;
135this option restricts the output to the public components.
136This option is automatically set if the input is a public key.
137
138When combined with B<-text>, this is equivalent to B<-text_pub>.
139
140=item B<-noout>
141
142Do not output the key in encoded form.
143
144=item B<-text>
145
146Output the various key components in plain text
147(possibly in addition to the PEM encoded form).
148This cannot be combined with encoded output in DER format.
149
150=item B<-text_pub>
151
152Output in text form only the public key components (also for private keys).
153This cannot be combined with encoded output in DER format.
154
155=item B<-ec_conv_form> I<arg>
156
157This option only applies to elliptic-curve based keys.
158
159This specifies how the points on the elliptic curve are converted
160into octet strings. Possible values are: B<compressed> (the default
161value), B<uncompressed> and B<hybrid>. For more information regarding
162the point conversion forms please read the X9.62 standard.
163B<Note> Due to patent issues the B<compressed> option is disabled
164by default for binary curves and can be enabled by defining
165the preprocessor macro B<OPENSSL_EC_BIN_PT_COMP> at compile time.
166
167=item B<-ec_param_enc> I<arg>
168
169This option only applies to elliptic curve based public and private keys.
170
171This specifies how the elliptic curve parameters are encoded.
172Possible value are: B<named_curve>, i.e. the ec parameters are
173specified by an OID, or B<explicit> where the ec parameters are
174explicitly given (see RFC 3279 for the definition of the
175EC parameters structures). The default value is B<named_curve>.
176B<Note> the B<implicitlyCA> alternative, as specified in RFC 3279,
177is currently not implemented in OpenSSL.
178
179=back
180
181=head1 EXAMPLES
182
183To remove the pass phrase on a private key:
184
185 openssl pkey -in key.pem -out keyout.pem
186
187To encrypt a private key using triple DES:
188
189 openssl pkey -in key.pem -des3 -out keyout.pem
190
191To convert a private key from PEM to DER format:
192
193 openssl pkey -in key.pem -outform DER -out keyout.der
194
195To print out the components of a private key to standard output:
196
197 openssl pkey -in key.pem -text -noout
198
199To print out the public components of a private key to standard output:
200
201 openssl pkey -in key.pem -text_pub -noout
202
203To just output the public part of a private key:
204
205 openssl pkey -in key.pem -pubout -out pubkey.pem
206
207To change the EC parameters encoding to B<explicit>:
208
209 openssl pkey -in key.pem -ec_param_enc explicit -out keyout.pem
210
211To change the EC point conversion form to B<compressed>:
212
213 openssl pkey -in key.pem -ec_conv_form compressed -out keyout.pem
214
215=head1 SEE ALSO
216
217L<openssl(1)>,
218L<openssl-genpkey(1)>,
219L<openssl-rsa(1)>,
220L<openssl-pkcs8(1)>,
221L<openssl-dsa(1)>,
222L<openssl-genrsa(1)>,
223L<openssl-gendsa(1)>
224
225=head1 HISTORY
226
227The B<-engine> option was deprecated in OpenSSL 3.0.
228
229=head1 COPYRIGHT
230
231Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
232
233Licensed under the Apache License 2.0 (the "License").  You may not use
234this file except in compliance with the License.  You can obtain a copy
235in the file LICENSE in the source distribution or at
236L<https://www.openssl.org/source/license.html>.
237
238=cut
239