<DRAFT!>			HOWTO keys1. IntroductionKeys are the basis of public key algorithms and PKI.  Keys usuallycome in pairs, with one half being the public key and the other halfbeing the private key.  With OpenSSL, the private key contains thepublic key information as well, so a public key doesn't need to begenerated separately.Public keys come in several flavors, using different cryptographicalgorithms.  The most popular ones associated with certificates areRSA and DSA, and this HOWTO will show how to generate each of them.2. To generate a RSA keyA RSA key can be used both for encryption and for signing.Generating a key for the RSA algorithm is quite easy, all you have todo is the following:  openssl genrsa -des3 -out privkey.pem 2048With this variant, you will be prompted for a protecting password.  Ifyou don't want your key to be protected by a password, remove the flag'-des3' from the command line above.    NOTE: if you intend to use the key together with a server    certificate, it may be a good thing to avoid protecting it    with a password, since that would mean someone would have to    type in the password every time the server needs to access    the key.The number 2048 is the size of the key, in bits.  Today, 2048 orhigher is recommended for RSA keys, as fewer amount of bits isconsider insecure or to be insecure pretty soon.3. To generate a DSA keyA DSA key can be used for signing only.  This is important to keepin mind to know what kind of purposes a certificate request with aDSA key can really be used for.Generating a key for the DSA algorithm is a two-step process.  First,you have to generate parameters from which to generate the key:  openssl dsaparam -out dsaparam.pem 2048The number 2048 is the size of the key, in bits.  Today, 2048 orhigher is recommended for DSA keys, as fewer amount of bits isconsider insecure or to be insecure pretty soon.When that is done, you can generate a key using the parameters inquestion (actually, several keys can be generated from the sameparameters):  openssl gendsa -des3 -out privkey.pem dsaparam.pemWith this variant, you will be prompted for a protecting password.  Ifyou don't want your key to be protected by a password, remove the flag'-des3' from the command line above.    NOTE: if you intend to use the key together with a server    certificate, it may be a good thing to avoid protecting it    with a password, since that would mean someone would have to    type in the password every time the server needs to access    the key.-- Richard Levitte