ecdsa.com

Export public key PEM · OpenSSL

How to export a public key as PEM with OpenSSL

openssl pkey -pubout derives the public key from any ECDSA private key and writes it as SPKI PEM in one command — the same invocation regardless of whether the private key is modern PKCS#8 or legacy SEC1.

Tested with OpenSSL 3.6.

Same recipe in:Node.jsPythonGoOpenSSLWebCrypto
derive the public key
openssl pkey -in key.pem -pubout -out pub.pem
cat pub.pem   # -----BEGIN PUBLIC KEY-----
inspect what you exported
openssl pkey -pubin -in pub.pem -text -noout
# shows the uncompressed point (04‖x‖y) and the curve: prime256v1
same key from other containers
openssl x509 -in cert.pem -pubkey -noout > pub.pem   # from a certificate
openssl ec -in legacy.pem -pubout -out pub.pem       # legacy tool, same output

How it works

  1. pkey is the format-agnostic key tool in OpenSSL 3.x — it reads PKCS#8 and SEC1 private keys without extra flags.
  2. -pubout switches the output from private to public; the result is always the SPKI BEGIN PUBLIC KEY container.
  3. Reading a public key back requires -pubin — without it, pkey assumes the input is private and fails.

Gotchas

  • Forgetting -pubin when inspecting a public key gives Could not read private key — misleading wording for "you gave me a public key without saying so".
  • There is no way to go from public back to private — if -pubout is your backup strategy, you have backed up the wrong half.
  • An encrypted private key prompts for the passphrase even for -pubout (the public half lives inside the encrypted structure) — automation needs -passin or an unencrypted working copy.

Related recipes