From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Sun, 25 Mar 2018 13:08:36 +0000 (+0100)
Subject: DKIM: document generation of RSA keys
X-Git-Tag: exim-4_91_RC3~20
X-Git-Url: https://git.exim.org/users/heiko/exim.git/commitdiff_plain/f3908561b1eef15d57608ab6b346125bf2a11478

DKIM: document generation of RSA keys
---

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 978d51fd7..7d5b3b3cf 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -38932,6 +38932,20 @@ is set.
 .endlist
 
 .new
+To generate keys under OpenSSL:
+.code
+openssl genrsa -out dkim_rsa.private 2048
+openssl rsa -in dkim_rsa.private -out /dev/stdout -pubout -outform PEM
+.endd
+Take the base-64 lines from the output of the second command, concatenated,
+for the DNS TXT record.
+
+Under GnuTLS:
+.code
+certtool --generate-privkey --rsa --bits=2048 --password='' -8 --outfile=dkim_rsa.private
+certtool --load-privkey=dkim_rsa.private --pubkey-info
+.endd
+
 Note that RFC 8301 says:
 .code
 Signers MUST use RSA keys of at least 1024 bits for all keys.