Generate a private key

Everything in this module builds on one secret: a private key. The certificate, the signatures, the trust decisions — all of them assume that only you control this file. A private key proves control of an identity. Generate it on the system where it will be protected and avoid copying it through chat, logs, or source control.

We start with the key for our lab certificate authority. Create an encrypted lab CA key:

openssl genpkey -algorithm RSA -aes-256-cbc -out lab-ca.key -pkeyopt rsa_keygen_bits:3072

OpenSSL prompts for a passphrase and writes the key encrypted with AES-256. -pkeyopt rsa_keygen_bits:3072 picks a 3072-bit RSA key, a solid choice for a CA key that will sign other certificates. The passphrase means a stolen file is not immediately a stolen identity.

Confirm the file exists and restrict it to its owner:

chmod 600 lab-ca.key
ls -l lab-ca.key
# -rw------- 1 flavio flavio 2.6K Aug  3 10:20 lab-ca.key

The -rw------- permissions mean only the owning user can read or write the file. On a shared machine, that line is the difference between a secret and a leak.

Use openssl pkey -in lab-ca.key -check -noout to validate the structure:

openssl pkey -in lab-ca.key -check -noout
# Key is valid

You will be asked for the passphrase, then OpenSSL checks the key’s internal consistency. Key is valid is the output you want. This command never prints the key material itself, which is exactly how you should inspect keys: look at properties, not contents.

A realistic failure: you generate the key as root during setup, then the server process running as another user cannot read it. The symptom is a permission-denied error at startup, not a TLS error. Check ownership with ls -l before suspecting the key itself.

One note on the passphrase. For unattended server keys, encryption requires a deliberate secure unlock mechanism — someone or something must supply the passphrase at every restart. Never remove protection casually just to make automation easier. Decide where the secret lives first, then choose whether the key file is encrypted.