I know how to generate an RSA Private Key and CSR:

openssl genrsa -out my.key.pem 2048
openssl req -new -sha256 -key my.key.pem -out my.csr

But, how do I do the same with an ECDSA (Elliptic Curve Digital Signature Algorithm)?


2 Answers 2


For a list of possible curve names, run:

openssl ecparam -list_curves

Then, pick a curve from the list and replace your first line with:

openssl ecparam -name secp521r1 -genkey -noout -out my.key.pem

(replace secp521r1 with whichever curve you choose from the list)

Finally, generate the CSR as you have done:

openssl req -new -sha256 -key my.key.pem -out my.csr
  • If he/she wants to use it in a TLS server, then they will also need to use a named curve, and not domain parameters. That means ecparam and -param_enc named_curve will need to be used. Also see Elliptic Curve Cryptography | Named Curves on the OpenSSL wiki.
    – jww
    Aug 10, 2016 at 17:58
  • @jww -param_enc named_curve appears to be the default, at least with newer version of OpenSSL. Thus leaving it out should be OK. Feb 10, 2017 at 16:46
  • 2
    Private keys should be password protected.
    – phbits
    Mar 27, 2020 at 17:14
  • 1
    openssl ecparam -genkey -name secp521r1 | openssl ec -aes256 -out my.key.pem
    – phbits
    Mar 27, 2020 at 17:14

Based on the accepted answer, I'd like to use genpkey command for more general usage:

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp521r1 -out my.key.pem

-algorithm, -pkeyopt can be referred to openssl man and KEY GENERATION OPTIONS


openssl req -new -sha256 -key my.key.pem -out my.csr

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .