Why does openssl rsa produce PKCS#8 output on my machine?

Because you are on OpenSSL 3.x, where the default output format for openssl rsa changed to PKCS#8. Add -traditional to get the PKCS#1 form. This silently surprises a lot of scripts written against OpenSSL 1.1.1.

Do I actually need PKCS#1?

Rarely, and less often every year. Some older tooling — certain Java libraries, some hardware appliances and a few embedded TLS stacks — accept only BEGIN RSA PRIVATE KEY . If nothing is demanding it, PKCS#8 is the better format to keep.

Can I convert an EC key to PKCS#1?

No. PKCS#1 is defined for RSA only. The equivalent traditional format for EC keys is SEC1, which you get with openssl ec -in pkcs8.key -out sec1.key and which produces a BEGIN EC PRIVATE KEY header.

What happens to an encrypted input?

OpenSSL prompts for the passphrase to read it, then writes the output unencrypted unless you ask for encryption with a flag such as -aes256 . Check the output header before deploying it, because an accidentally unencrypted key on disk is easy to miss.

Convert a PKCS#8 key to PKCS#1

To convert a PKCS#8 RSA key to PKCS#1, run `openssl rsa -in pkcs8.key -traditional -out pkcs1.key`. The `-traditional` flag is essential on OpenSSL 3.x — without it `openssl rsa` writes PKCS#8 output, because OpenSSL 3 changed the default output format for this subcommand. On OpenSSL 1.x the flag does not exist and is not needed, since PKCS#1 was already the default. Only RSA keys have a PKCS#1 form; an EC key converts to the equivalent SEC1 format with `openssl ec -in pkcs8.key -out sec1.key`.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

The command #

PKCS#8 to PKCS#1 on OpenSSL 3.x

openssl rsa -in pkcs8.key -traditional -out pkcs1.key

On OpenSSL 1.x, the flag does not exist and the default is already what you want:

openssl rsa -in pkcs8.key -out pkcs1.key

EC keys #

There is no PKCS#1 for elliptic curve keys. The traditional format is SEC1:

PKCS#8 EC key to SEC1

openssl ec -in pkcs8.key -out sec1.key

Expected output

writing EC key

That produces a -----BEGIN EC PRIVATE KEY----- file.

Keeping the output encrypted #

By default the output is unencrypted, even when the input was not:

Convert and re-encrypt in one step

openssl rsa -in pkcs8.key -traditional -aes256 -out pkcs1.key

Verify the conversion #

Same key, different wrapper — the public keys must match

openssl pkey -in pkcs8.key -pubout | openssl sha256
openssl pkey -in pkcs1.key -pubout | openssl sha256

head -n1 pkcs1.key

Expected output

-----BEGIN RSA PRIVATE KEY-----

Going the other way #

See convert PKCS#1 to PKCS#8.

Frequently asked questions

Why does openssl rsa produce PKCS#8 output on my machine?: Because you are on OpenSSL 3.x, where the default output format for openssl rsa changed to PKCS#8. Add -traditional to get the PKCS#1 form. This silently surprises a lot of scripts written against OpenSSL 1.1.1.
Do I actually need PKCS#1?: Rarely, and less often every year. Some older tooling — certain Java libraries, some hardware appliances and a few embedded TLS stacks — accept only BEGIN RSA PRIVATE KEY. If nothing is demanding it, PKCS#8 is the better format to keep.
Can I convert an EC key to PKCS#1?: No. PKCS#1 is defined for RSA only. The equivalent traditional format for EC keys is SEC1, which you get with openssl ec -in pkcs8.key -out sec1.key and which produces a BEGIN EC PRIVATE KEY header.
What happens to an encrypted input?: OpenSSL prompts for the passphrase to read it, then writes the output unencrypted unless you ask for encryption with a flag such as -aes256. Check the output header before deploying it, because an accidentally unencrypted key on disk is easy to miss.

References

openssl-pkcs8(1) — converting back out of PKCS#8
RFC 8017: PKCS #1 RSA cryptography — the RSA-only key format that PKCS#8 generalised