How to generate RSA/ECC/SM keys - Mobile Platform as a Service

Use OpenSSL to generate RSA, ECC, or SM2 key pairs for use with mPaaS.

Prerequisites

Before you begin, ensure that you have:

OpenSSL version 1.1.1 or later, installed from the official OpenSSL website

Quick reference

All three key types follow the same two-step pattern: generate the private key, then derive the public key from it.

# RSA — generate a 2048-bit private key, then derive the public key
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
openssl rsa -pubout -in private_key.pem -out public_key.pem

# ECC (secp256k1 curve) — generate a private key, then derive the public key
openssl ecparam -name secp256k1 -genkey -noout -out secp256k1-key.pem
openssl ec -in secp256k1-key.pem -pubout -out ecpubkey.pem

# SM2 — generate a private key, then derive the public key
openssl ecparam -name SM2 -genkey -noout -out sm2-key.pem
openssl ec -in sm2-key.pem -pubout -out sm2pubkey.pem

Generate an RSA key

Generate an RSA private key. mPaaS supports 1024-bit and 2048-bit key lengths; 2048-bit is recommended.
```
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
```
This produces private_key.pem, your RSA private key. Keep this file secure and never share it.
Derive the RSA public key from the private key.
```
openssl rsa -pubout -in private_key.pem -out public_key.pem
```
This produces public_key.pem, the public key you upload to mPaaS.

Generate an ECC key

mPaaS requires the secp256k1 elliptic curve for ECC keys.

Generate an ECC private key on the secp256k1 curve.
```
openssl ecparam -name secp256k1 -genkey -noout -out secp256k1-key.pem
```
This produces secp256k1-key.pem, your ECC private key.
Derive the ECC public key from secp256k1-key.pem.
```
openssl ec -in secp256k1-key.pem -pubout -out ecpubkey.pem
```
This produces ecpubkey.pem, the public key you upload to mPaaS.

Generate an SM key

Generate the SM2 private key sm2-key.pem.

openssl ecparam -name SM2 -genkey -noout -out sm2-key.pem

Derive the SM2 public key sm2pubkey.pem from sm2-key.pem.
```
openssl ec -in sm2-key.pem -pubout -out sm2pubkey.pem
```