PKI --GEN(1) strongSwan PKI --GEN(1)

# [NAME](#NAME)

pki --gen - Generate a new RSA or ECDSA private key

# [SYNOPSIS](#SYNOPSIS)

`pki --gen` \[**--type** *type*] \[**--size** *bits*] \[**--safe-primes**] \[**--shares** *n*] \[**--threshold** *l*] \[**--outform** *encoding*] \[**--debug** *level*]

`pki --gen` **--options file**

`pki --gen` **-h** | **--help**

# [DESCRIPTION](#DESCRIPTION)

This sub-command of [**pki**(1)](/man/enterprise-packages/strongswan/pki.1) is used to generate a new RSA or ECDSA private key.

# [OPTIONS](#OPTIONS)

[**-h, --help**](#h,)

Print usage information with a summary of the available options.

[**-v, --debug level**](#v,)

Set debug level, default: 1.

**-+, --options file**

Read command line options from *file*.

[**-t, --type type**](#t,)

Type of key to generate. Either *rsa*, *ecdsa*, *ed25519*, or *ed448*, defaults to *rsa*.

[**-s, --size bits**](#s,)

Key length in bits. Defaults to 2048 for *rsa* and 384 for *ecdsa*. For *ecdsa* only three values are currently supported: 256, 384 and 521.

[**-p, --safe-primes**](#p,)

Generate RSA safe primes.

[**-f, --outform encoding**](#f,)

Encoding of the generated private key. Either *der* (ASN.1 DER) or *pem* (Base64 PEM), defaults to *der*.

## [RSA Threshold Cryptography](#RSA_Threshold_Cryptography)

[**-n, --shares <n>**](#n,)

Number of private RSA key shares.

[**-l, --threshold <l>**](#l,)

Minimum number of participating RSA key shares.

# [PROBLEMS ON HOSTS WITH LOW ENTROPY](#PROBLEMS_ON_HOSTS_WITH_LOW_ENTROPY)

If the *gmp* plugin is used to generate RSA private keys the key material is read from */dev/random* (via the *random* plugin). Therefore, the command may block if the system's entropy pool is empty. To avoid this, either use a hardware random number generator to feed */dev/random* or use OpenSSL (via the *openssl* plugin or the command line) which is not as strict in regards to the quality of the key material (it reads from */dev/urandom* if necessary). It is also possible to configure the devices used by the *random* plugin in [**strongswan.conf**(5)](/man/enterprise-packages/strongswan/strongswan.conf.5). Setting **libstrongswan.plugins.random.random** to */dev/urandom* forces the plugin to treat bytes read from */dev/urandom* as high grade random data, thus avoiding the blocking. Of course, this doesn't change the fact that the key material generated this way is of lower quality.

# [EXAMPLES](#EXAMPLES)

[**pki --gen --size 3072 > rsa\_key.der**](#pki)

Generates a 3072-bit RSA private key.

[**pki --gen --type ecdsa --size 256 > ecdsa\_key.der**](#pki~2)

Generates a 256-bit ECDSA private key.

# [SEE ALSO](#SEE_ALSO)

[**pki**(1)](/man/enterprise-packages/strongswan/pki.1)

2016-12-13 6.1.0

---

Document: pki---gen(1) from strongswan 6.1.0-r3 (Chainguard OS)
Source: https://github.com/strongswan/strongswan