(PowerShell) Generate RSA Key and Export to PKCS1 / PKCS8

PowerShell example code showing how to generate an RSA public/private key and save to PKCS1 and PKCS8 format files. In a PKCS1 or PKCS8 formatted file, the key is stored in binary ASN.1 format (and ASN.1 is itself written according to DER -- Distinguished Encoding Rules). A PEM file simply contains the binary ASN.1 base64 encoded and delimited by BEGIN/END lines. PKCS1 format files are never encrypted. PKCS8 can be encrypted or unencrypted. Public keys are never encrypted (there is no need). Private keys *should* always be encrypted - unless perhaps the unencrypted private key is obtained and itself stored in some sort of secure place.

Note: This example requires Chilkat v11.0.0 or greater.

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-x64\ChilkatDotNet47.dll"

$success = $false

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

$rsa = New-Object Chilkat.Rsa

# Generate a 2048-bit key.  Chilkat RSA supports
# key sizes ranging from 512 bits to 8192 bits.
$privKey = New-Object Chilkat.PrivateKey
$success = $rsa.GenKey(2048,$privKey)
if ($success -eq $false) {
    $($rsa.LastErrorText)
    exit
}

# Get the public key
$pubKey = New-Object Chilkat.PublicKey
$privKey.ToPublicKey($pubKey)

# Get the public key as a PKCS8 PEM string
$pubKeyPem = $pubKey.GetPem($false)
$($pubKeyPem)

# Get the public key in PKCS8 format, in a Base64 encoded string.
$pubKeyPkcs8Base64 = $pubKey.GetEncoded($false,"base64")
$($pubKeyPkcs8Base64)

# Get the public key in PKCS1 format, in a Base64 encoded string.
$pubKeyPkcs1Base64 = $pubKey.GetEncoded($true,"base64")
$($pubKeyPkcs1Base64)

# Get the private key in a PKCS8 PEM string.
$privKeyPem = $privKey.GetPkcs8Pem()
$($privKeyPem)

# Get the private key in a PKCS8 encrypted PEM string.
$privKeyEncPem = $privKey.GetPkcs8EncryptedPem("myPassword")
$($privKeyEncPem)

# Get the private key in PKCS1 Base64 format
$privKeyPkcs1Base64 = $privKey.GetPkcs1ENC("base64")
$($privKeyPkcs1Base64)

# Get the private key in PKCS8 Base64 format
$privKeyPkcs8Base64 = $privKey.GetPkcs8ENC("base64")
$($privKeyPkcs8Base64)

# Save to PKCS1 / PKCS8 / PEM files...

# Save the public key to PKCS8 binary DER
$success = $pubKey.SaveDerFile($false,"pubKey_pkcs8.der")

# Save the public key to PKCS1 binary DER
$success = $pubKey.SaveDerFile("pubKey_pkcs1.der")

# Save the private key to unencrypted binary PKCS1 DER.
# Note: PKCS1 is never found in an encrypted format. 
$success = $privKey.SavePkcs1File("privKey_pkcs1.der")

# Save the private key to unencrypted binary PKCS8
$success = $privKey.SavePkcs8File("privKey_pkcs8.der")

# Save the private key to encrypted binary PKCS8
$success = $privKey.SavePkcs8EncryptedFile("myPassword","privKey_enc_pkcs8.der")

# Save the private key to unencrypted PKCS8 PEM
$success = $privKey.SavePkcs8PemFile("privKey.pem")

# Save the private key to encrypted PKCS8 PEM
$success = $privKey.SavePkcs8EncryptedPemFile("myPassword","privKey_enc.pem")