Search code examples
securityencryptionopensslecdsa

Openssl ECDSA : private key passphrase

I am new with Openssl i have generated a private key myprivatekey.pem and a publickey mypublickey.pem with :

openssl ecparam -genkey -name secp160k1 -noout -out myprivatekey.pem

and my public key with :

openssl -ec  -in myprivatekey.pem -pubout -out mypublickey.pem

What i want to do next is to encrypte my ecdsa with a passphrase private key and make a certification request for my public key and thank you for your help.

Solution

  • It would seem that ecparam doesn't have a built-in option for encrypting the generated key. Instead, you can simply do the following:

    openssl ec -in myprivatekey.pem -out myprivatekey_encrypted.pem -aes256

    Compared to genrsa, an extra step is required, but this basically does the same thing.

    Now as far as the certificate request, the command is pretty much the same regardless of the type of private key used:

    openssl req -new -sha256 -key myprivatekey.pem -out mycertrequest.pem

    You can then take the resulting mycertrequest.pem and send it to a CA for signing.

    Edit:

    If you have concerns about writing the unencrypted private key to disk, you can do both the generation and encryption of the key in one step like so:

    openssl ecparam -genkey -name secp256k1 | openssl ec -aes256 -out privatekey.pem

    This generates a P-256 key, then prompts you for a passphrase. The key is then encrypted using AES256 and saved into privatekey.pem.