When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key file, it starts and ends with -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----, which gives feeling that this file is just the private key. Why is that? This makes me very confused.

If I want to encrypt a message using private key, do I apply the entire yourdomain.key key? Or should I extract the private key part from it and use that?


2 Answers 2


Do not use the OpenSSL command line to encrypt or sign anything. The OpenSSL command line is a debugging tool. To encrypt or sign a message, use a tool designed for this purpose, such as GPG.

A private key file contains all the information needed to construct the public key. If you have a private key in a format that OpenSSL understands and you want to get the corresponding public key, you can use openssl pkey -pubout …. But that's not the format GPG needs. GPG generates its own keys.

  • 4
    "The OpenSSL command line is a debugging tool." Why would that disqualify it? You could still use the generated key to encrypt a message, right? Whether it's compatible with GPG is another matter.
    – Mast
    Sep 18, 2019 at 9:11
  • 9
    It's not a debugging tool. It's perfectly fine to use it to encrypt things. GPG is just easier to use so you're less likely to do the wrong thing.
    – OrangeDog
    Sep 18, 2019 at 9:38
  • 2
    @LightnessRacesinOrbit Precisely: the question makes an incorrect (but excusable) assumption that openssl is in any way a usable tool to encrypt data. You can do it if you know exactly what you're doing and you avoid the myriad ways to do it wrong and you don't care about using any standard format. It's one of those things where if you need to ask, don't do it. Sep 18, 2019 at 10:20
  • 4
    @LightnessRacesinOrbit No. They now know how to get something that works functionally. We're on Information Security, getting something that works functionally is not the goal. Sep 18, 2019 at 11:23
  • 2
    If you can explain to us why the OpenSSL solution is insecure, or unsafe, or unsound, that would make a valid critique of Thorium's answer. But just making broad claims and assertions without explanation, and discussing unmentioned technologies as if they had been the premise of the question, is not the goal of any SE site. Sep 18, 2019 at 12:09

The private key is used to decrypt, and to sign things. You don't use it to encrypt. You use the public key for that. But openssl genrsa will not generate the public key, only the private. To encrypt things, you must first generate the public key (so you have a keypair: private and public):

openssl rsa -in yourdomain.key -outform PEM -pubout -out public.pem

This will create public.pem file with, well, the public key. Use it to encript the file:

openssl rsautl -encrypt -inkey public.pem  -pubin -in file.txt -out file.enc

To decrypt later, you use the private key:

openssl rsautl -decrypt -inkey yourdomain.key -in file.enc  -out file.dec
  • 1
    what do you think signing is if not encrypting information? Related: security.stackexchange.com/questions/9957/…
    – eis
    Sep 18, 2019 at 5:21
  • but in general, of course, you're correct, and this answer is probably what OP needs
    – eis
    Sep 18, 2019 at 5:23
  • 1
    "You don't use it to encrypt" Depends on what you're trying to do, obviously.
    – Hugo
    Sep 18, 2019 at 8:31
  • 2
    @eis As I understand it, signing usually involves only encrypting a hash of the data being signed: the data itself usually isn't encrypted (as part of the signing process).
    – TripeHound
    Sep 18, 2019 at 9:26
  • @eis Signing is not encrypting. Not at all. They're completely different operations. Even with RSA. RSA is more than just the exponentiation operation, which is the only part that works the same in both direction. Key generation and encoding are completely different. Sep 18, 2019 at 10:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .