I know how to generate an RSA Private Key and CSR:
openssl genrsa -out my.key.pem 2048
openssl req -new -sha256 -key my.key.pem -out my.csr
But, how do I do the same with an ECDSA (Elliptic Curve Digital Signature Algorithm)?
For a list of possible curve names, run:
openssl ecparam -list_curves
Then, pick a curve from the list and replace your first line with:
openssl ecparam -name secp521r1 -genkey -noout -out my.key.pem
(replace secp521r1
with whichever curve you choose from the list)
Finally, generate the CSR as you have done:
openssl req -new -sha256 -key my.key.pem -out my.csr
ecparam
and -param_enc named_curve
will need to be used. Also see Elliptic Curve Cryptography | Named Curves on the OpenSSL wiki.
-param_enc named_curve
appears to be the default, at least with newer version of OpenSSL. Thus leaving it out should be OK.
Feb 10, 2017 at 16:46
openssl ecparam -genkey -name secp521r1 | openssl ec -aes256 -out my.key.pem
Based on the accepted answer, I'd like to use genpkey
command for more general usage:
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp521r1 -out my.key.pem
-algorithm
,-pkeyopt
can be referred to openssl man and KEY GENERATION OPTIONS
Then:
openssl req -new -sha256 -key my.key.pem -out my.csr