Home / server / Questions / 1047966
Accepted
71GA
Asked: 2020-12-30 11:15:55 +0800 CST

DKIM - key pair generation recommendations

  • 772

I wonder if it is okay to generate a key pair (.key and .cert files) for DKIM like this:

openssl req -newkey rsa:2048 -sha256 -x509 -nodes -days 3650 -keyout dkim-rsa.key -out dkim-rsa.cert

By reading RFC 6376 I can see that standards only demand RSA algorythm sha256 and maximum length of 2048. Are there any other recommenrdations that you would have for me before I create the keys?

openssl dkim

1 Answers

  1. Best Answer

    With DKIM you don't create an X.509 certificate, but just private and public keys:

    openssl genrsa -out private.key 2048
openssl rsa -in private.key -pubout -out public.key

    As the public key is not given in the message but fetched from the DNS it doesn't require the additional features of an X.509 certificate.

    • 3