When a key is generated with
openssl genrsa, the encryption is selected with a command line argument such as
-aes128. After the key is generated, we can see what encryption was used in the file. Ex:
cat host.key -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,AF4EBC2AE861F6FE8C751F7DAD5D4721 ... -----END RSA PRIVATE KEY-----
When a key is generated via
openssl req -newkey rsa:2048 -keyout host.key, the file does not tell what encryption was used.
-----BEGIN ENCRYPTED PRIVATE KEY----- ... -----END ENCRYPTED PRIVATE KEY-----
What is it?
openssl rsa -in host.key know how to decrypt the key?
openssl req does encrypt by default with DES-EDE3-CBC.
openssl req -new -x509 -out server.cer -keyout server.key -subj "/CN=toto/" Generating a 1024 bit RSA private key ..................++++++ ..++++++ writing new private key to 'server.key' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- cat server.key -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,02306CD22AAC94CD -----END RSA PRIVATE KEY-----
The problem is with my orignal command. It specified a config which influences key generation in some way still escaping me.
By default, the config will assume
encrypt_key = yes. That leads to the key being encrypted with an unspecified algo. Specifying
encrypt_key = no under the
[req] section is equivalent to the
The following questions remain though:
- What encryption is applied by openssl req when a config is specified?
- Can the algorithm be controlled?
- How does
openssl rsaguess the right cipher for decryption? It must obviously be encoded somewhere in the data...
At first it seems nice to have
openssl req generate the key for me. But
genrsa offers more control.