What is the difference between these openssl commands:

  • "openssl genrsa"
  • "openssl genpkey"
  • "openssl req -newkey rsa:bits [everything else]"

Which one should I be using when preparing a new CSR?

  • Possible duplicate? Maybe consider changing question title?
    – Tom Hale
    Commented Jan 25, 2023 at 14:13

1 Answer 1


The key generation code is the same in all three cases anyway. This is just a matter of command-line interface.

For most usages, I recommend generating the private key with req because then that's only one command line to generate the key and the certificate request. All other things being equal, less complexity makes for more security.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .