what are the current best practices for key generation

Question

What is the difference between these openssl commands:

• "openssl genrsa"
• "openssl genpkey"
• "openssl req -newkey rsa:bits [everything else]"

Which one should I be using when preparing a new CSR?

Answer 1

The key generation code is the same in all three cases anyway. This is just a matter of command-line interface.

For most usages, I recommend generating the private key with req because then that's only one command line to generate the key and the certificate request. All other things being equal, less complexity makes for more security.