Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I run this command to generate a CSR and a new key with openssl:

openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/ -keyout /etc/ssl/private/

I can't figure out what command I can run to generate just the key and not the CSR?

share|improve this question
Check the man page for openssl. req is PKCS#10 X.509 Certificate Signing Request (CSR) Management. That means that you can't use req to work with something other than CSRs. Depending on what you really want to do, commands like passwd, pkey or rand may fit the bill better. –  Michael Kjörling Jul 19 '13 at 18:07
Thanks, what I want to know is what will produce the exact same kind of key as the req above. I think it is something like openssl genrsa -out /etc/ssl/private/ 2048, just not sure? –  Jack Douglas Jul 19 '13 at 18:10
@Michael sorry, I should point out that the req in the question does produce a key because of the -keyout - that might have not been clear enough in the question. –  Jack Douglas Jul 19 '13 at 18:17
Thanks for the post. I found many usefull commands to generate csr, key and self-signed crt on the fly with one command in non-interactive mode. Here is the link - ,maybe if would be usefull –  user99144 Jan 13 at 20:29
@aprogrammer - thanks for the link, the commands on that page are useful, but the rest of the page is in Russian. Here's the Google translated URL for that page:…. –  slm Jan 13 at 22:48

1 Answer 1

up vote 4 down vote accepted

Yes the genrsa switch is the key that's getting generated in the req command. To generate the key I believe you just need to run this command:

$ openssl genrsa -out clientkey.pem

I always reference this page titled: The Most Common OpenSSL Commands - SSL Shopper. You can see from the examples that the key for a CSR is RSA, you can even control it's length when using the req command through the rsa:2048 parameter.


  • Generate a new private key and Certificate Signing Request

    $ openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
  • Generate a certificate signing request (CSR) for an existing private key

    $ openssl req -out CSR.csr -key privateKey.key -new

In the above you'll notice the use of the privateKey.key from the previous step being used to create the CSR.


share|improve this answer
Thanks, just what I wanted to know. I had found that page and noticed that it didn't have a command to generate a standalone key, which I think is a bit odd, don't you? –  Jack Douglas Jul 19 '13 at 20:07
@JackDouglas - yes I usually use that page plus several others to "refresh" my memories on how openssl works 8-). I've been meaning to write them up on my blog, when I can find the time. –  slm Jul 19 '13 at 20:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.