Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/strongswan/strongswan/llms.txt

Use this file to discover all available pages before exploring further.

pki --gen generates a new private key. The key is written in DER format by default, or PEM format when --outform pem is specified.

​
Synopsis

pki --gen [--type <type>] [--size <bits>] [--safe-primes] [--shares <n>] [--threshold <t>] [--outform <format>] [--out <file>]

​
Options

​
--type
string
default:"rsa"
Key type to generate. Accepted values:
  • rsa — RSA key (default)
  • ecdsa — ECDSA key
  • ed25519 — Ed25519 key (Edwards-curve DSA, 256-bit)
  • ed448 — Ed448 key (Edwards-curve DSA, 448-bit)
​
--size
number
Key size in bits. Applies to RSA and ECDSA only; Ed25519 and Ed448 have fixed key sizes.Default sizes when omitted:
  • RSA: 2048
  • ECDSA: 384
Common values:
  • RSA: 2048, 3072, 4096
  • ECDSA: 256, 384, 521
​
--safe-primes
boolean
Generate RSA key using safe primes. This increases generation time significantly but may be required for certain compliance scenarios.
​
--shares
number
Number of key shares to split the private key into (threshold secret sharing). Must be 2 or greater. Used together with --threshold.
​
--threshold
number
default:"1"
Minimum number of shares required to reconstruct the private key. Must be at least 1 and no greater than --shares.
​
--outform
string
default:"der"
Output encoding format. Accepted values: pem, der. Output is written to stdout; redirect with > to save to a file.

​
Examples

Generate an Ed25519 key (recommended for new deployments): 
pki --gen --type ed25519 --outform pem > moonKey.pem
Generate a 3072-bit RSA key: 
pki --gen --type rsa --size 3072 --outform pem > moonKey.pem
Generate a 384-bit ECDSA key: 
pki --gen --type ecdsa --size 384 --outform pem > moonKey.pem
Generate a 4096-bit RSA key: 
pki --gen --type rsa --size 4096 --outform pem > strongswanKey.pem
Ed25519 and Ed448 keys do not require a --size argument. They are fixed-length by design and generally offer better performance than RSA at equivalent security levels.
The key is written in DER (binary) format by default. Use --outform pem when the key will be stored in a file or referenced by swanctl.conf.