I know how to generate an RSA Private Key and CSR:
openssl genrsa -out my.key.pem 2048
openssl req -new -sha256 -key my.key.pem -out my.csr
But, how do I do the same with an ECDSA (Elliptic Curve Digital Signature Algorithm)?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this communityI know how to generate an RSA Private Key and CSR:
openssl genrsa -out my.key.pem 2048
openssl req -new -sha256 -key my.key.pem -out my.csr
But, how do I do the same with an ECDSA (Elliptic Curve Digital Signature Algorithm)?
For a list of possible curve names, run:
openssl ecparam -list_curves
Then, pick a curve from the list and replace your first line with:
openssl ecparam -name secp521r1 -genkey -noout -out my.key.pem
(replace secp521r1
with whichever curve you choose from the list)
Finally, generate the CSR as you have done:
openssl req -new -sha256 -key my.key.pem -out my.csr
ecparam
and -param_enc named_curve
will need to be used. Also see Elliptic Curve Cryptography | Named Curves on the OpenSSL wiki.
-param_enc named_curve
appears to be the default, at least with newer version of OpenSSL. Thus leaving it out should be OK.
Feb 10 '17 at 16:46
openssl ecparam -genkey -name secp521r1 | openssl ec -aes256 -out my.key.pem