Key Pair (Public and Private Key)

A key pair is two linked cryptographic keys: a public key you can share freely and a private key you must keep secret. Data signed with the private key can be verified by anyone with the public key, and data encrypted to the public key can be read only with the private key.

Why it matters

Key pairs are the foundation of TLS, SSH, code signing, DKIM and many token formats. In a TLS certificate, the CA signs your public key. During the handshake, your server proves possession of the matching private key. Anyone who steals the private key can impersonate your site until the certificate is revoked or expires.

Common algorithms are RSA (2048 bits or more is typical) and elliptic-curve options such as ECDSA P-256 and Ed25519, which give comparable security with smaller keys and faster handshakes.

Example

openssl ecparam -name prime256v1 -genkey -noout -out server.key
openssl ec -in server.key -pubout -out server.pub
chmod 600 server.key

The first command creates the private key, the second extracts the public key, and the last restricts file access.

Common mistakes

• Emailing or committing private keys to a repository.
• Reusing one key across many unrelated servers.
• Keeping the same key for years instead of rotating at renewal.

Related

• Public key
• Private key
• Asymmetric encryption
• Digital signature

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.