[root@node101.yinzhengjie.org.cn ~]# yum search openssl

Loaded plugins: fastestmirror

Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast

Determining fastest mirrors

 * base: mirrors.huaweicloud.com

 * extras: mirrors.tuna.tsinghua.edu.cn

 * updates: mirrors.huaweicloud.com

=========================================================================== N/S matched: openssl ===========================================================================

apr-util-openssl.x86_64 : APR utility library OpenSSL crytpo support

openssl-devel.i686 : Files for development of applications which will use OpenSSL

openssl-devel.x86_64 : Files for development of applications which will use OpenSSL

openssl-perl.x86_64 : Perl scripts provided with OpenSSL

openssl-static.i686 : Libraries for static linking of applications which will use OpenSSL

openssl-static.x86_64 : Libraries for static linking of applications which will use OpenSSL

perl-Crypt-OpenSSL-Bignum.x86_64 : Perl interface to OpenSSL for Bignum

perl-Crypt-OpenSSL-RSA.x86_64 : Perl interface to OpenSSL for RSA

perl-Crypt-OpenSSL-Random.x86_64 : Perl interface to OpenSSL for Random

pyOpenSSL.x86_64 : Python wrapper module around the OpenSSL library

pyOpenSSL-doc.noarch : Documentation for pyOpenSSL

xmlsec1-openssl.i686 : OpenSSL crypto plugin for XML Security Library

xmlsec1-openssl.x86_64 : OpenSSL crypto plugin for XML Security Library

xmlsec1-openssl-devel.i686 : OpenSSL crypto plugin for XML Security Library

xmlsec1-openssl-devel.x86_64 : OpenSSL crypto plugin for XML Security Library

m2crypto.x86_64 : Support for using OpenSSL in python scripts

nss_compat_ossl.i686 : Source-level compatibility library for OpenSSL to NSS porting

nss_compat_ossl.x86_64 : Source-level compatibility library for OpenSSL to NSS porting

openssl.x86_64 : Utilities from the general purpose cryptography library with TLS implementation

openssl-libs.i686 : A general purpose cryptography library with TLS implementation

openssl-libs.x86_64 : A general purpose cryptography library with TLS implementation

openssl098e.i686 : A compatibility version of a general cryptography and TLS library

openssl098e.x86_64 : A compatibility version of a general cryptography and TLS library

perl-Crypt-SSLeay.x86_64 : Crypt::SSLeay - OpenSSL glue that provides LWP https support

perl-Net-SSLeay.x86_64 : Perl extension for using OpenSSL

qca-ossl.i686 : OpenSSL plugin for the Qt Cryptographic Architecture v2

qca-ossl.x86_64 : OpenSSL plugin for the Qt Cryptographic Architecture v2

  Name and summary matches only, use "search all" for everything.

[root@node101.yinzhengjie.org.cn ~]# 

[root@node101.yinzhengjie.org.cn ~]# yum info openssl-libs

Loaded plugins: fastestmirror

Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast

Loading mirror speeds from cached hostfile

 * base: mirrors.huaweicloud.com

 * extras: mirrors.tuna.tsinghua.edu.cn

 * updates: mirrors.huaweicloud.com

Installed Packages

Name        : openssl-libs

Arch        : x86_64

Epoch       : 1

Version     : 1.0.2k

Release     : 16.el7

Size        : 3.1 M

Repo        : installed

From repo   : anaconda

Summary     : A general purpose cryptography library with TLS implementation

URL         : http://www.openssl.org/

License     : OpenSSL

Description : OpenSSL is a toolkit for supporting cryptography. The openssl-libs

            : package contains the libraries that are used by various applications which

            : support cryptographic algorithms and protocols.

Available Packages

Name        : openssl-libs

Arch        : i686

Epoch       : 1

Version     : 1.0.2k

Release     : 16.el7_6.1

Size        : 994 k

Repo        : updates/7/x86_64

Summary     : A general purpose cryptography library with TLS implementation

URL         : http://www.openssl.org/

License     : OpenSSL

Description : OpenSSL is a toolkit for supporting cryptography. The openssl-libs

            : package contains the libraries that are used by various applications which

            : support cryptographic algorithms and protocols.

Name        : openssl-libs

Arch        : x86_64

Epoch       : 1

Version     : 1.0.2k

Release     : 16.el7_6.1

Size        : 1.2 M

Repo        : updates/7/x86_64

Summary     : A general purpose cryptography library with TLS implementation

URL         : http://www.openssl.org/

License     : OpenSSL

Description : OpenSSL is a toolkit for supporting cryptography. The openssl-libs

            : package contains the libraries that are used by various applications which

            : support cryptographic algorithms and protocols.

[root@node101.yinzhengjie.org.cn ~]# 

[root@node101.yinzhengjie.org.cn ~]# openssl

OpenSSL> ?

openssl:Error: '?' is an invalid command.

Standard commands

asn1parse         ca                ciphers           cms

crl               crl2pkcs7         dgst              dh

dhparam           dsa               dsaparam          ec

ecparam           enc               engine            errstr

gendh             gendsa            genpkey           genrsa

nseq              ocsp              passwd            pkcs12

pkcs7             pkcs8             pkey              pkeyparam

pkeyutl           prime             rand              req

rsa               rsautl            s_client          s_server

s_time            sess_id           smime             speed

spkac             ts                verify            version

x509              

Message Digest commands (see the `dgst' command for more details)

md2               md4               md5               rmd160

sha               sha1              

Cipher commands (see the `enc' command for more details)

aes-128-cbc       aes-128-ecb       aes-192-cbc       aes-192-ecb

aes-256-cbc       aes-256-ecb       base64            bf

bf-cbc            bf-cfb            bf-ecb            bf-ofb

camellia-128-cbc  camellia-128-ecb  camellia-192-cbc  camellia-192-ecb

camellia-256-cbc  camellia-256-ecb  cast              cast-cbc

cast5-cbc         cast5-cfb         cast5-ecb         cast5-ofb

des               des-cbc           des-cfb           des-ecb

des-ede           des-ede-cbc       des-ede-cfb       des-ede-ofb

des-ede3          des-ede3-cbc      des-ede3-cfb      des-ede3-ofb

des-ofb           des3              desx              idea

idea-cbc          idea-cfb          idea-ecb          idea-ofb

rc2               rc2-40-cbc        rc2-64-cbc        rc2-cbc

rc2-cfb           rc2-ecb           rc2-ofb           rc4

rc4-40            rc5               rc5-cbc           rc5-cfb

rc5-ecb           rc5-ofb           seed              seed-cbc

seed-cfb          seed-ecb          seed-ofb          zlib              

OpenSSL> quit

[root@node101.yinzhengjie.org.cn ~]# 

[root@node101.yinzhengjie.org.cn ~]# man enc

ENC(1)                                                                          OpenSSL                                                                          ENC(1)

NAME

       enc - symmetric cipher routines

SYNOPSIS

       openssl enc -ciphername [-in filename] [-out filename] [-pass arg] [-e] [-d] [-a/-base64] [-A] [-k password] [-kfile filename] [-K key] [-iv IV] [-S salt]

       [-salt] [-nosalt] [-z] [-md] [-p] [-P] [-bufsize number] [-nopad] [-debug] [-none] [-engine id]

DESCRIPTION

       The symmetric cipher commands allow data to be encrypted or decrypted using various block and stream ciphers using keys based on passwords or explicitly

       provided. Base64 encoding or decoding can also be performed either by itself or in addition to the encryption or decryption.

OPTIONS

       -in filename

           the input filename, standard input by default.

       -out filename

           the output filename, standard output by default.

       -pass arg

           the password source. For more information about the format of arg see the PASS PHRASE ARGUMENTS section in openssl(1).

       -salt

           use a salt in the key derivation routines. This is the default.

       -nosalt

           don't use a salt in the key derivation routines. This option SHOULD NOT be used except for test purposes or compatibility with ancient versions of OpenSSL

           and SSLeay.

       -e  encrypt the input data: this is the default.

       -d  decrypt the input data.

      -a  base64 process the data. This means that if encryption is taking place the data is base64 encoded after encryption. If decryption is set then the input data

           is base64 decoded before being decrypted.

       -base64

           same as -a

       -A  if the -a option is set then base64 process the data on one line.

       -k password

           the password to derive the key from. This is for compatibility with previous versions of OpenSSL. Superseded by the -pass argument.

       -kfile filename

           read the password to derive the key from the first line of filename.  This is for compatibility with previous versions of OpenSSL. Superseded by the -pass

           argument.

       -nosalt

           do not use a salt

       -salt

           use salt (randomly generated or provide with -S option) when encrypting (this is the default).

       -S salt

           the actual salt to use: this must be represented as a string of hex digits.

       -K key

           the actual key to use: this must be represented as a string comprised only of hex digits. If only the key is specified, the IV must additionally specified

           using the -iv option. When both a key and a password are specified, the key given with the -K option will be used and the IV generated from the password

           will be taken. It probably does not make much sense to specify both key and password.

       -iv IV

           the actual IV to use: this must be represented as a string comprised only of hex digits. When only the key is specified using the -K option, the IV must

           explicitly be defined. When a password is being specified using one of the other options, the IV is generated from this password.

       -p  print out the key and IV used.

       -P  print out the key and IV used then immediately exit: don't do any encryption or decryption.

       -bufsize number

           set the buffer size for I/O

       -nopad

           disable standard block padding

       -debug

           debug the BIOs used for I/O.

       -z  Compress or decompress clear text using zlib before encryption or after decryption. This option exists only if OpenSSL with compiled with zlib or zlib-

           dynamic option.

       -none

           Use NULL cipher (no encryption or decryption of input).

NOTES

       The program can be called either as openssl ciphername or openssl enc -ciphername. But the first form doesn't work with engine-provided ciphers, because this

       form is processed before the configuration file is read and any ENGINEs loaded.

       Engines which provide entirely new encryption algorithms (such as ccgost engine which provides gost89 algorithm) should be configured in the configuration file.

       Engines, specified in the command line using -engine options can only be used for hadrware-assisted implementations of ciphers, which are supported by OpenSSL

       core or other engine, specified in the configuration file.

       When enc command lists supported ciphers, ciphers provided by engines, specified in the configuration files are listed too.

       A password will be prompted for to derive the key and IV if necessary.

       The -salt option should ALWAYS be used if the key is being derived from a password unless you want compatibility with previous versions of OpenSSL and SSLeay.

       Without the -salt option it is possible to perform efficient dictionary attacks on the password and to attack stream cipher encrypted data. The reason for this

       is that without the salt the same password always generates the same encryption key. When the salt is being used the first eight bytes of the encrypted data are

       reserved for the salt: it is generated at random when encrypting a file and read from the encrypted file when it is decrypted.

       Some of the ciphers do not have large keys and others have security implications if not used correctly. A beginner is advised to just use a strong block cipher

       in CBC mode such as bf or des3.

       All the block ciphers normally use PKCS#5 padding also known as standard block padding: this allows a rudimentary integrity or password check to be performed.

       However since the chance of random data passing the test is better than 1 in 256 it isn't a very good test.

       If padding is disabled then the input data must be a multiple of the cipher block length.

       All RC2 ciphers have the same key and effective key length.

       Blowfish and RC5 algorithms use a 128 bit key.

SUPPORTED CIPHERS

       Note that some of these ciphers can be disabled at compile time and some are available only if an appropriate engine is configured in the configuration file.

       The output of the enc command run with unsupported options (for example openssl enc -help) includes a list of ciphers, supported by your versesion of OpenSSL,

       including ones provided by configured engines.

       The enc program does not support authenticated encryption modes like CCM and GCM. The utility does not store or retrieve the authentication tag.

        base64             Base 64

        bf-cbc             Blowfish in CBC mode

        bf                 Alias for bf-cbc

        bf-cfb             Blowfish in CFB mode

        bf-ecb             Blowfish in ECB mode

        bf-ofb             Blowfish in OFB mode

        cast-cbc           CAST in CBC mode

        cast               Alias for cast-cbc

        cast5-cbc          CAST5 in CBC mode

        cast5-cfb          CAST5 in CFB mode

        cast5-ecb          CAST5 in ECB mode

     cast5-ofb          CAST5 in OFB mode

        des-cbc            DES in CBC mode

        des                Alias for des-cbc

        des-cfb            DES in CBC mode

        des-ofb            DES in OFB mode

        des-ecb            DES in ECB mode

        des-ede-cbc        Two key triple DES EDE in CBC mode

        des-ede            Two key triple DES EDE in ECB mode

        des-ede-cfb        Two key triple DES EDE in CFB mode

        des-ede-ofb        Two key triple DES EDE in OFB mode

        des-ede3-cbc       Three key triple DES EDE in CBC mode

        des-ede3           Three key triple DES EDE in ECB mode

        des3               Alias for des-ede3-cbc

        des-ede3-cfb       Three key triple DES EDE CFB mode

        des-ede3-ofb       Three key triple DES EDE in OFB mode

        desx               DESX algorithm.

        gost89             GOST 28147-89 in CFB mode (provided by ccgost engine)

        gost89-cnt        `GOST 28147-89 in CNT mode (provided by ccgost engine)

        idea-cbc           IDEA algorithm in CBC mode

        idea               same as idea-cbc

        idea-cfb           IDEA in CFB mode

        idea-ecb           IDEA in ECB mode

        idea-ofb           IDEA in OFB mode

        rc2-cbc            128 bit RC2 in CBC mode

        rc2                Alias for rc2-cbc

        rc2-cfb            128 bit RC2 in CFB mode

        rc2-ecb            128 bit RC2 in ECB mode

       rc2-ofb            128 bit RC2 in OFB mode

        rc2-64-cbc         64 bit RC2 in CBC mode

        rc2-40-cbc         40 bit RC2 in CBC mode

        rc4                128 bit RC4

        rc4-64             64 bit RC4

        rc4-40             40 bit RC4

        rc5-cbc            RC5 cipher in CBC mode

        rc5                Alias for rc5-cbc

        rc5-cfb            RC5 cipher in CFB mode

        rc5-ecb            RC5 cipher in ECB mode

        rc5-ofb            RC5 cipher in OFB mode

        aes-[128|192|256]-cbc  128/192/256 bit AES in CBC mode

        aes-[128|192|256]      Alias for aes-[128|192|256]-cbc

        aes-[128|192|256]-cfb  128/192/256 bit AES in 128 bit CFB mode

        aes-[128|192|256]-cfb1 128/192/256 bit AES in 1 bit CFB mode

        aes-[128|192|256]-cfb8 128/192/256 bit AES in 8 bit CFB mode

        aes-[128|192|256]-ecb  128/192/256 bit AES in ECB mode

        aes-[128|192|256]-ofb  128/192/256 bit AES in OFB mode

EXAMPLES

       Just base64 encode a binary file:

        openssl base64 -in file.bin -out file.b64

       Decode the same file

        openssl base64 -d -in file.b64 -out file.bin

       Encrypt a file using triple DES in CBC mode using a prompted password:

        openssl des3 -salt -in file.txt -out file.des3

       Decrypt a file using a supplied password:

        openssl des3 -d -salt -in file.des3 -out file.txt -k mypassword

       Encrypt a file then base64 encode it (so it can be sent via mail for example) using Blowfish in CBC mode:

        openssl bf -a -salt -in file.txt -out file.bf

       Base64 decode a file then decrypt it:

        openssl bf -d -salt -a -in file.bf -out file.txt

       Decrypt some data using a supplied 40 bit RC4 key:

        openssl rc4-40 -in file.rc4 -out file.txt -K 0102030405

BUGS

       The -A option when used with large files doesn't work properly.

       There should be an option to allow an iteration count to be included.

       The enc program only supports a fixed number of algorithms with certain parameters. So if, for example, you want to use RC2 with a 76 bit key or RC4 with an 84

       bit key you can't use this program.

1.0.2k                                                                         2017-01-26                                                                        ENC(1)

[root@node101.yinzhengjie.org.cn ~]# man dgst

DGST(1)                                                                         OpenSSL                                                                         DGST(1)

NAME

       dgst, sha, sha1, mdc2, ripemd160, sha224, sha256, sha384, sha512, md2, md4, md5, dss1 - message digests

SYNOPSIS

       openssl dgst [-sha|-sha1|-mdc2|-ripemd160|-sha224|-sha256|-sha384|-sha512|-md2|-md4|-md5|-dss1] [-c] [-d] [-hex] [-binary] [-r] [-non-fips-allow] [-out

       filename] [-sign filename] [-keyform arg] [-passin arg] [-verify filename] [-prverify filename] [-signature filename] [-hmac key] [-non-fips-allow]

       [-fips-fingerprint] [file...]

       openssl [digest] [...]

DESCRIPTION

       The digest functions output the message digest of a supplied file or files in hexadecimal.  The digest functions also generate and verify digital signatures

       using message digests.

OPTIONS

       -c  print out the digest in two digit groups separated by colons, only relevant if hex format output is used.

       -d  print out BIO debugging information.

       -hex

           digest is to be output as a hex dump. This is the default case for a "normal" digest as opposed to a digital signature.  See NOTES below for digital

           signatures using -hex.

       -binary

           output the digest or signature in binary form.

       -r  output the digest in the "coreutils" format used by programs like sha1sum.

       -non-fips-allow

           Allow use of non FIPS digest when in FIPS mode.  This has no effect when not in FIPS mode.

       -out filename

           filename to output to, or standard output by default.

       -sign filename

           digitally sign the digest using the private key in "filename".

       -keyform arg

           Specifies the key format to sign digest with. The DER, PEM, P12, and ENGINE formats are supported.

       -engine id

           Use engine id for operations (including private key storage).  This engine is not used as source for digest algorithms, unless it is also specified in the

           configuration file.

       -sigopt nm:v

           Pass options to the signature algorithm during sign or verify operations.  Names and values of these options are algorithm-specific.

       -passin arg

           the private key password source. For more information about the format of arg see the PASS PHRASE ARGUMENTS section in openssl(1).

       -verify filename

           verify the signature using the the public key in "filename".  The output is either "Verification OK" or "Verification Failure".

       -prverify filename

           verify the signature using the  the private key in "filename".

       -signature filename

           the actual signature to verify.

       -hmac key

           create a hashed MAC using "key".

       -mac alg

           create MAC (keyed Message Authentication Code). The most popular MAC algorithm is HMAC (hash-based MAC), but there are other MAC algorithms which are not

           based on hash, for instance gost-mac algorithm, supported by ccgost engine. MAC keys and other options should be set via -macopt parameter.

     -macopt nm:v

           Passes options to MAC algorithm, specified by -mac key.  Following options are supported by both by HMAC and gost-mac:

           key:string

                   Specifies MAC key as alphnumeric string (use if key contain printable characters only). String length must conform to any restrictions of the MAC

                   algorithm for example exactly 32 chars for gost-mac.

           hexkey:string

                   Specifies MAC key in hexadecimal form (two hex digits per byte).  Key length must conform to any restrictions of the MAC algorithm for example

                   exactly 32 chars for gost-mac.

       -rand file(s)

           a file or files containing random data used to seed the random number generator, or an EGD socket (see RAND_egd(3)).  Multiple files can be specified

           separated by a OS-dependent character.  The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

       -non-fips-allow

           enable use of non-FIPS algorithms such as MD5 even in FIPS mode.

       -fips-fingerprint

           compute HMAC using a specific key for certain OpenSSL-FIPS operations.

       file...

           file or files to digest. If no files are specified then standard input is used.

EXAMPLES

       To create a hex-encoded message digest of a file:

        openssl dgst -md5 -hex file.txt

       To sign a file using SHA-256 with binary file output:

        openssl dgst -sha256 -sign privatekey.pem -out signature.sign file.txt

       To verify a signature:

        openssl dgst -sha256 -verify publickey.pem \

        -signature signature.sign \

        file.txt

NOTES

       The digest of choice for all new applications is SHA1. Other digests are however still widely used.

       When signing a file, dgst will automatically determine the algorithm (RSA, ECC, etc) to use for signing based on the private key's ASN.1 info.  When verifying

       signatures, it only handles the RSA, DSA, or ECDSA signature itself, not the related data to identify the signer and algorithm used in formats such as x.509,

       CMS, and S/MIME.

       A source of random numbers is required for certain signing algorithms, in particular ECDSA and DSA.

       The signing and verify options should only be used if a single file is being signed or verified.

       Hex signatures cannot be verified using openssl.  Instead, use "xxd -r" or similar program to transform the hex signature into a binary signature prior to

       verification.

1.0.2k                                                                         2017-01-26                                                                       DGST(1)

[root@node101.yinzhengjie.org.cn ~]# man sslpasswd

PASSWD(1)                                                                       OpenSSL                                                                       PASSWD(1)

NAME

       passwd - compute password hashes

SYNOPSIS

       openssl passwd [-crypt] [-1] [-apr1] [-salt string] [-in file] [-stdin] [-noverify] [-quiet] [-table] {password}

DESCRIPTION

       The passwd command computes the hash of a password typed at run-time or the hash of each password in a list.  The password list is taken from the named file for

       option -in file, from stdin for option -stdin, or from the command line, or from the terminal otherwise.  The Unix standard algorithm crypt and the MD5-based

       BSD password algorithm 1 and its Apache variant apr1 are available.

OPTIONS

       -crypt

           Use the crypt algorithm (default).

       -1  Use the MD5 based BSD password algorithm 1.

       -apr1

           Use the apr1 algorithm (Apache variant of the BSD algorithm).

       -salt string

           Use the specified salt.  When reading a password from the terminal, this implies -noverify.

       -in file

           Read passwords from file.

       -stdin

           Read passwords from stdin.

       -noverify

           Don't verify when reading a password from the terminal.

       -quiet

           Don't output warnings when passwords given at the command line are truncated.

       -table

           In the output list, prepend the cleartext password and a TAB character to each password hash.

EXAMPLES

       openssl passwd -crypt -salt xx password prints xxj31ZMTZzkVA.

       openssl passwd -1 -salt xxxxxxxx password prints $1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a..

       openssl passwd -apr1 -salt xxxxxxxx password prints $apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0.

1.0.2k                                                                         2017-01-26                                                                     PASSWD(1)

[root@node101.yinzhengjie.org.cn ~]# man sslrand

RAND(1)                                                                         OpenSSL                                                                         RAND(1)

NAME

       rand - generate pseudo-random bytes

SYNOPSIS

       openssl rand [-out file] [-rand file(s)] [-base64] [-hex] num

DESCRIPTION

       The rand command outputs num pseudo-random bytes after seeding the random number generator once.  As in other openssl command line tools, PRNG seeding uses the

       file $HOME/.rnd or .rnd in addition to the files given in the -rand option.  A new $HOME/.rnd or .rnd file will be written back if enough seeding was obtained

       from these sources.

OPTIONS

       -out file

           Write to file instead of standard output.

       -rand file(s)

           Use specified file or files or EGD socket (see RAND_egd(3)) for seeding the random number generator.  Multiple files can be specified separated by a OS-

           dependent character.  The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

       -base64

           Perform base64 encoding on the output.

       -hex

           Show the output as a hex string.

SEE ALSO

       RAND_bytes(3)

1.0.2k                                                                         2017-01-26                                                                       RAND(1)

[root@node101.yinzhengjie.org.cn ~]# man genrsa

GENRSA(1)                                                                       OpenSSL                                                                       GENRSA(1)

NAME

       genrsa - generate an RSA private key

SYNOPSIS

       openssl genrsa [-out filename] [-passout arg] [-aes128] [-aes192] [-aes256] [-camellia128] [-camellia192] [-camellia256] [-des] [-des3] [-idea] [-f4] [-3]

       [-rand file(s)] [-engine id] [numbits]

DESCRIPTION

       The genrsa command generates an RSA private key.

OPTIONS

       -out filename

           the output filename. If this argument is not specified then standard output is used.

       -passout arg

           the output file password source. For more information about the format of arg see the PASS PHRASE ARGUMENTS section in openssl(1).

       -aes128|-aes192|-aes256|-camellia128|-camellia192|-camellia256|-des|-des3|-idea

           These options encrypt the private key with specified cipher before outputting it. If none of these options is specified no encryption is used. If encryption

           is used a pass phrase is prompted for if it is not supplied via the -passout argument.

       -F4|-3

           the public exponent to use, either 65537 or 3. The default is 65537.

       -rand file(s)

           a file or files containing random data used to seed the random number generator, or an EGD socket (see RAND_egd(3)).  Multiple files can be specified

           separated by a OS-dependent character.  The separator is ; for MS-Windows, , for OpenVMS, and : for all others.

       -engine id

           specifying an engine (by its unique id string) will cause genrsa to attempt to obtain a functional reference to the specified engine, thus initialising it

           if needed. The engine will then be set as the default for all available algorithms.

       numbits

           the size of the private key to generate in bits. This must be the last option specified. The default is 512.

NOTES

       RSA private key generation essentially involves the generation of two prime numbers. When generating a private key various symbols will be output to indicate

       the progress of the generation. A . represents each number which has passed an initial sieve test, + means a number has passed a single round of the Miller-

       Rabin primality test. A newline means that the number has passed all the prime tests (the actual number depends on the key size).

       Because key generation is a random process the time taken to generate a key may vary somewhat.

BUGS

       A quirk of the prime generation algorithm is that it cannot generate small primes. Therefore the number of bits should not be less that 64. For typical private

       keys this will not matter because for security reasons they will be much larger (typically 1024 bits).

SEE ALSO

       gendsa(1)

1.0.2k                                                                         2017-01-26                                                                     GENRSA(1)

[root@node101.yinzhengjie.org.cn ~/ssl]# cat test.key

-----BEGIN RSA PRIVATE KEY-----

MIICXQIBAAKBgQC7n9G30qtd+8kr4Z4lFskT5aS+6/7DYr10k9TI+fgbWBpRbsnc

wPPQV+YVMn12KYtVoglgIAbDeRTfygS4q8NFqk9kYRKRlzcBIsVkem5I5P5BM9y0

2CaYZDohwOniTK5yc886EjBkvTCcglWo2oCcUdjN8+4ZoQaauoK6T0K72QIDAQAB

AoGAcpM9SWkf9wusJNzpazLH5huliGWrNPvWQBuKpJRpm6EoqTPjl6hI+6DBw44K

qZ7jFI8X9Jh6KOKHCcZfLbrOSm/KMjjVsb/3YCG174wyI+U7RCqWU/xH8FMhmOeG

LlSJIycwOnWq6CGDOsmWyhbepYX3+uoucIHU3qxUG1/p+FECQQDi6CXV0/bmBb6O

2odsgY047m5Q35tFR1ZrzhTJ1ZNfwaizFbfl0Mt4Fstm8Ie3dQAp3HjR+686NXNc

M6VN5QklAkEA065JDAj6PAzHhmnn0bCG/k8NUii9ksUuXT8WotdmgVzIUWHbiPtO

mws3v6nbZYBy0tSSX34/itpwQB5Agj5LpQJBAL7DoZuF2ttEFRMQ0i39NPeaLRC9

DVNPSG7WEVAmyQIGVIhLSBJkWcuajmL68X7hVMPc4Y7YZFcxvMzVdrJoTikCQQC6

jHHbpV3B5hFAp7yg001keQ5oRXcsDZHao2qzf9jaUIZJElCC29ZeVPiAdJThUt3e

Z2/HsF8XY4JhP0figDvxAkAcszHvpgCIV+831m8kv4XrXLL2yMqqALV8CzAXBtWX

X8gZ+pbI4yC+QfMg4Hj2h4HRPN/qRfs3zkeinsnhGZ0Y

-----END RSA PRIVATE KEY-----

[root@node101.yinzhengjie.org.cn ~/ssl]# 

[root@node101.yinzhengjie.org.cn ~/ssl]# cat test2.key

-----BEGIN RSA PRIVATE KEY-----

Proc-Type: 4,ENCRYPTED

DEK-Info: DES-EDE3-CBC,A10A88A3A65686C4

g2uwaR6TgLObrkEAz/VNGzWhmH4IHd3XHceYnP8M0ReMARjk/keiATkQ1MmBY++M

dP+f77+g/u3Oq8SbqqJNwBKHC+rZeWjcRI0nDJ7gcDtxxq0VsAno6aUeRxRt5xrV

HsjoohpVjty9K0/ioE7y69JcYaxhuGotvxmReKWoL8DKvo73EJh5ZP/wMNNBtl7w

8Xh4SD/QqsmJ8HLX/O0rmo2INT8ahvHrhBA4cnAvnjqjPpt8BJbhYZakDbG3pAg6

abd9o6X0Tr3jWI9YxV8KkXZTpIsmbL4lhWE2pdLafDDDCd+zoVTbrRbA9vm76A1+

Jl0mX1ndl5DwC/S6gs4pW2EQX99tmWad/xYMVpB1j3UdBRsi+1LG8oFS0ngStGxv

RjNl1zGPUhm226SnM5P2Urj2X7TiwRQbLirqI0iJlELhvK8AVAsG2UWPpy1B8y4p

2Gkvu9l4YDBP3iH5OsctzI14aU3NWTRhUUNwVZZbRo+YfjQ6bDx6/8ZUf9iNYGQW

vlbuXLl3/SzaDjhoigXke5JxH31cN4IbQMbhzCZP5uemYaFdcPRSKGt5hyIj/Uxj

moZHfyk21pCtiCV2KipK8hOjXXJmu1yvtrvmtbg7mKiE4wt2G7qTeVFSN/KwF6kf

TJnPonWgqliaO20bg3a0nNgmpkdb/qKmj1xt7HCDQt+xVM98JFVPfuFtcjhDi75L

5BQ+Qt0IXVh1QkSvaB4QdU4ZICozX5cJYWO1EPBvuqOr2BL8bFapAvsADZRaXP+b

wuUVHkUc7+vCzFyvNaorVKQFB0+TBJYib6ycjpCRxqY5AcqcY9HHWQ==

-----END RSA PRIVATE KEY-----

[root@node101.yinzhengjie.org.cn ~/ssl]# 

[root@node101.yinzhengjie.org.cn ~/ssl]# cat test2.key

-----BEGIN RSA PRIVATE KEY-----

Proc-Type: 4,ENCRYPTED

DEK-Info: DES-EDE3-CBC,A10A88A3A65686C4

g2uwaR6TgLObrkEAz/VNGzWhmH4IHd3XHceYnP8M0ReMARjk/keiATkQ1MmBY++M

dP+f77+g/u3Oq8SbqqJNwBKHC+rZeWjcRI0nDJ7gcDtxxq0VsAno6aUeRxRt5xrV

HsjoohpVjty9K0/ioE7y69JcYaxhuGotvxmReKWoL8DKvo73EJh5ZP/wMNNBtl7w

8Xh4SD/QqsmJ8HLX/O0rmo2INT8ahvHrhBA4cnAvnjqjPpt8BJbhYZakDbG3pAg6

abd9o6X0Tr3jWI9YxV8KkXZTpIsmbL4lhWE2pdLafDDDCd+zoVTbrRbA9vm76A1+

Jl0mX1ndl5DwC/S6gs4pW2EQX99tmWad/xYMVpB1j3UdBRsi+1LG8oFS0ngStGxv

RjNl1zGPUhm226SnM5P2Urj2X7TiwRQbLirqI0iJlELhvK8AVAsG2UWPpy1B8y4p

2Gkvu9l4YDBP3iH5OsctzI14aU3NWTRhUUNwVZZbRo+YfjQ6bDx6/8ZUf9iNYGQW

vlbuXLl3/SzaDjhoigXke5JxH31cN4IbQMbhzCZP5uemYaFdcPRSKGt5hyIj/Uxj

moZHfyk21pCtiCV2KipK8hOjXXJmu1yvtrvmtbg7mKiE4wt2G7qTeVFSN/KwF6kf

TJnPonWgqliaO20bg3a0nNgmpkdb/qKmj1xt7HCDQt+xVM98JFVPfuFtcjhDi75L

5BQ+Qt0IXVh1QkSvaB4QdU4ZICozX5cJYWO1EPBvuqOr2BL8bFapAvsADZRaXP+b

wuUVHkUc7+vCzFyvNaorVKQFB0+TBJYib6ycjpCRxqY5AcqcY9HHWQ==

-----END RSA PRIVATE KEY-----

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# openssl rsa -in test2.key -out test2.bak.key

Enter pass phrase for test2.key:

writing RSA key

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# ll

total 12

-rw-r--r-- 1 root root 887 Dec 21 10:28 test2.bak.key

-rw------- 1 root root 963 Dec 21 10:23 test2.key

-rw------- 1 root root 887 Dec 21 10:24 test.key

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# cat test2.bak.key

-----BEGIN RSA PRIVATE KEY-----

MIICXQIBAAKBgQC0X5rHhleCbl3XxD8ygpOHtXCTADc8eJIvigc0pUqGFJGBAlHq

I/GMho1SvDYDKO7zxhztd6h807wQiRmmr9gCExJButPJENmZ4CJcbguVjVnySMxc

3Tm8JQiGerMsP654bh0+yYEwPnAqFHC8Ca9mxJLmtNokDSKP78e9LDYt8QIDAQAB

AoGAbIgiT/BL85WJLe1NwYzETKImLK2yjtZVz/kTwN+8adUygBfvRh1+mHnVy3So

Y1pb/Z61hUW8we99d82m+59PL1zZf/aQ1FBgfiyv8WXEnWsEs8J1PpvlDKfGr9X4

3KqEd8KnHHnrFI0sRXwk9AK3IFce3L7jCqpztlrG35R9eukCQQDpyhtBcW7KJtYW

pQHk3NOO0pLD6Lf/Re38e+SBuc2ijvpDpt+ZEAPl6hkkTVJDcczlTucNQE7O3vwN

V/Tsb3AvAkEAxYJj1bTOeP3zLtb+IfLyc64ciqJuzvIF4RC0o4y3uZ1rjYxpLhT5

CFFjDq+pjXSX3vwzFbebiKvU6rMFyHmb3wJBAJlGlz39t4wzkBMClc5NdSpjJjPp

JJDpcREizPq8LXSRVsT56Ai69kNLirZBN1jeiF4ir9sBOWnpyciZzQsiOKMCQC8n

zWw1ieJLR2dUf0JdvdMuq7PRykDwecTddzNhInBXjFk0P9x3t2lr/QmBmSqjvqrH

be7uclz0IZaTfXr6xeMCQQCoQ9cgHu8SPQIXXXNrwuwlHmHqs4dURNLa6jJycsLQ

xIYVn3x5vl1mywwalMFQRzu4PWwydDHFosfAUpOSMZ0z

-----END RSA PRIVATE KEY-----

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# 

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# cd /etc/pki/tls/certs/

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]#

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]# ll

total 12

lrwxrwxrwx. 1 root root   49 Jul  8 16:23 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

lrwxrwxrwx. 1 root root   55 Jul  8 16:23 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

-rwxr-xr-x. 1 root root  610 Oct 31  2018 make-dummy-cert

-rw-r--r--. 1 root root 2516 Oct 31  2018 Makefile

-rwxr-xr-x. 1 root root  829 Oct 31  2018 renew-dummy-cert

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]#

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]# make ~/ssl/test100.key　　　　　　#进入到"/etc/pki/tls/certs"目录后使用make命令可以生成加密的私钥，主要是该目录有一个Makefile文件

umask 77 ; \

/usr/bin/openssl genrsa -aes128 2048 > /root/ssl/test100.key

Generating RSA private key, 2048 bit long modulus

.....................................................+++

...........................................................+++

e is 65537 (0x10001)

Enter pass phrase:

Verifying - Enter pass phrase:

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]#

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]# ll ~/ssl/test100.key

-rw------- 1 root root 1766 Dec 21 10:31 /root/ssl/test100.key

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]#

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]# cat ~/ssl/test100.key

-----BEGIN RSA PRIVATE KEY-----

Proc-Type: 4,ENCRYPTED

DEK-Info: AES-128-CBC,72305F310C826FAD49FF9DF021894C36

zs69lfGhV8a/GF6h6EJTKoBvCKSHs0Dn3jubW0FNUrh0IFC/RSn+Yhu2TWPdMp/j

3wZUbNYj8RTJ43yIfsoWTuBgTU1zlL2e1aTR5YO8VpfPHBT4hh5xnq9QWCTRPzk2

+FS2kpj/Iod3qmnOA2L8D00QMAQrc2anJYAJV8mQaRNfFaTw4Ka8zttgI6DiO6Pk

WYlPaD6e4EJkfUZF6kTm0CrUlRK+RRPoz4RzzBj33tXGxOCV4d6n0n2X07RnbRuE

Vayigy0p1jnW2ovC/IXWp13zYNXA4nWMqtljuqRN8ovrFdxY8DGkkUgPvYGQtKPZ

EfaIBctvgQtDrmmeOtcGLARoqGzTESPC5mzlMtU9Hc+UJnQZ87r/SUDhfrjWWC2m

4hmPzGaNcNjlW3zEs9jATnHjeHcAwvu1jGrhgGgrno2xsQv3eJzILRV7BQP5myiS

wl6whWB4SW5D/U5BHouM82Y4QJ6SX3MI3rG1PQ8M3dtyg9Miou5cVSbIF8BXBW7n

cfVjI7/B1HVQ4NIO89Sv15+fr+PGf46o2Ig8axep287itInEBZjCsmgLN0x9cC6T

W0P8NwjIXdrBOtCnuLxrlhrU2s0c2XfH4+Pal65QUkOWizLK88Y1RkLLXmGDb09D

1LYVcz2A2uM75Yh4zrFLtvJla/An/Qu9jvKGbgL7plB1dSSz4ajyeyYCnnM13A31

jmi2CmwAxJwTEbUSzCFtcGVCL7kvd7ETtnKZLgwAgXuEy3mxHu0aNYN2blc5222w

j19MLYBmbN4rd/Remhk2Y9vsBtygSJRNVoOEVEcnz4u12vsPIUO6HgAVbAARRXOK

rqaZD8+2qZxZq/um3pSt1VNufg66NIcP5f4Uww+F6AqC5XqOvCvoPxbqcqAEbxP/

wigmsPiqagfnpv/rtKArY/sHcpLeSUOrNGd6bDt7rVDY7zZdjgMmLbhxoaNCD8M3

CpFYhVEGH9A0hzY8KO+O/XZEMqwbsq1rMyjPQ2Rpz1CjpGG7/gVbPVlv7OoBEEqy

FvsP1v97kNG4SSFhAgIQdRsYKsSrM6Fj1k9BB0XVKGQK34o3r2WB9k2/IpYHZvPI

qam8LCFLI150L315gJJVKk453ZklQVKpZoI7voX4FG9x3XPuYKpywsjf/y/ErMpG

g52seo7igYHj5u63fbgpHGJRGpNAeMhKCxvXOkCUjl8e0OyowdpRmt61HVkHARae

q/BC+AX4KmOYEeHfytPe9vB74xERWy86wHGa6KU3IqcVWh/sWsTrDEuhwO0Kl3dD

6Trrw85PCv3l6NpU9I06sI2roNrtCPYXXMYPVcrmbnAxS2tpoqmevXrjf1cDocCl

1Bd2vdjIdYT92H3cB9My0RpgLb2cqPMP6GtjitJAIGWVmTPixcQsFjRpyhthuddX

DauxAzZh6X/DtjjeIPNXCkYnck6xWz8vU+fqr6kd1AXLyDA0MUJr8YuEXGn7SlFK

S9TgZY22S3waLHfVEBNp/u6m4b/BO4ZeSzqAu4cRfmFH7Lw49pRQebTPEOMchfO2

uZMvNYYiyjqwk00PcKBcX/yJHJyD/uUJ+yj2MGftUWBUY4elPUZ6EKLMSEPjf6SA

-----END RSA PRIVATE KEY-----

[root@node101.yinzhengjie.org.cn /etc/pki/tls/certs]# 

[root@node101.yinzhengjie.org.cn ~/ssl]# ll

total 16

-rw------- 1 root root 1766 Dec 21 10:31 test100.key

-rw-r--r-- 1 root root  887 Dec 21 10:28 test2.bak.key

-rw------- 1 root root  963 Dec 21 10:23 test2.key

-rw------- 1 root root  887 Dec 21 10:24 test.key

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# openssl rsa -in test100.key -pubout -out test100.pubkey 　　　　　　#从私钥中导出公钥，如果私钥设置的有密码需要验证密码后才能生成公钥文件

Enter pass phrase for test100.key:

writing RSA key

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# ll

total 20

-rw------- 1 root root 1766 Dec 21 10:31 test100.key

-rw-r--r-- 1 root root  451 Dec 21 10:35 test100.pubkey

-rw-r--r-- 1 root root  887 Dec 21 10:28 test2.bak.key

-rw------- 1 root root  963 Dec 21 10:23 test2.key

-rw------- 1 root root  887 Dec 21 10:24 test.key

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# openssl rsa -in test.key -pubout -out test.pubkey 　　　　　　　　#如果私钥文件没有设置密码则直接可以导出公钥

writing RSA key

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# ll

total 24

-rw------- 1 root root 1766 Dec 21 10:31 test100.key

-rw-r--r-- 1 root root  451 Dec 21 10:35 test100.pubkey

-rw-r--r-- 1 root root  887 Dec 21 10:28 test2.bak.key

-rw------- 1 root root  963 Dec 21 10:23 test2.key

-rw------- 1 root root  887 Dec 21 10:24 test.key

-rw-r--r-- 1 root root  272 Dec 21 10:36 test.pubkey

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# cat test100.pubkey

-----BEGIN PUBLIC KEY-----

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtt0fSFIhcbLMrObFw1nf

rp4HnL8s72RxtIKIrf0rEVRsgHt5AaW/wUFzeIn8nN0xrPwAwJFg2lNj+xBapXxu

61UU1CkLGblpdn1G+/eWWGsgkEw14UCg79Ifc5FLuaStraBOjAEYpXB5ge+KcFXE

IIULBUhBlmgzwXNFIM47ucy484JiwD4dXr3YTDRxWeVs0LMST3RmSJb5rq/ZnZJQ

n3t+wHfrUH8uoHnSpOaWrrLwGxdrNws8jUXFDv+T+63B8QGXjlQFEgs+sxyUo2n1

WO/9Sgop0CvSegjofKBD5bxVJsbrUAkYVD1sXEWhYb6juDLROECtxTfxV78evnW1

IwIDAQAB

-----END PUBLIC KEY-----

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]# cat test.pubkey

-----BEGIN PUBLIC KEY-----

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7n9G30qtd+8kr4Z4lFskT5aS+

6/7DYr10k9TI+fgbWBpRbsncwPPQV+YVMn12KYtVoglgIAbDeRTfygS4q8NFqk9k

YRKRlzcBIsVkem5I5P5BM9y02CaYZDohwOniTK5yc886EjBkvTCcglWo2oCcUdjN

8+4ZoQaauoK6T0K72QIDAQAB

-----END PUBLIC KEY-----

[root@node101.yinzhengjie.org.cn ~/ssl]#

[root@node101.yinzhengjie.org.cn ~/ssl]#