103

Using OpenSSL from the command line in Linux, is there some way to examine a key (either public or private) to determine the key size?

2
  • 1
    There are many different ways depending on the format of the keypair. Were you looking at a specific format?
    – Zoredache
    Commented Oct 27, 2011 at 19:55
  • 1
    As a rule of thumb, the size (in bytes) of a .pem RSA private key is roughly 3/4 of the size of the key length (in bits) - e.g. a 4096-bit key might be roughly 3247 bytes. File sizes do vary though.
    – mwfearnley
    Commented Dec 3, 2019 at 11:34

2 Answers 2

132
openssl rsa -in private.key -text -noout

The top line of the output will display the key size.

For example:

Private-Key: (2048 bit)

To view the key size from a certificate:

openssl x509 -in public.pem -text -noout | grep "Public Key"
RSA Public Key: (2048 bit)
3
  • 1
    And if he is using DSA, or something else. How about determining the key size from the public key(cert).
    – Zoredache
    Commented Oct 27, 2011 at 19:51
  • @Zoredache Yeah - I could have sworn the question said "private key" specifically; either I'm losing it or an edit beat the 5 minute timer. Commented Oct 27, 2011 at 20:13
  • 5
    OpenSSL 1.0.1g 7 Apr 2014 format requires | grep "Public-Key"
    – Vadzim
    Commented Sep 15, 2015 at 7:23
22

The first (2048) is the bit length of the key:

 $ ssh-keygen -lf /etc/ssh/rsa_key.pub 
 2048 91:1c:ae:17:16:...
2
  • 9
    He said 'openssl', not 'openssh'.
    – MikeyB
    Commented Oct 27, 2011 at 20:46
  • This would actually work on a private key generated by openssl genrsa. You would probably have to point it directly to the private key file though.
    – mwfearnley
    Commented Mar 19, 2021 at 14:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .