---
schema_version: "1"
id: 58d077baee1d2ea01a17aae0319ba4e1cd6477239b5efb77597d737a796271c6
title: Generate a Private-Public Key Pair
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_generate_private_key.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_generate_private_key.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c4dcfb24fe00556d8d2c46cc5060c4b418073aa3f099f9acaf46550dd3925515
description: DKIM authentication requires you to specify a private key in Business Manager in B2C Commerce. Generate a private key in a terminal with these commands.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Generate a Private-Public Key Pair

DKIM authentication requires you to specify a private key in Business Manager in B2C Commerce. Generate a private key in a terminal with these commands.

[Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US)

1. To generate a private key, enter `openssl genrsa -out private.pem 2048`.
2. Convert the private key to the p12 format.
    
    A p12 (PKCS#12) file is a secure, binary format used to store and transport private keys, public certificates, and intermediate CA certificates in a single, password-protected file.
    
    1. Enter `openssl req -new -key private.pem -out tmp.csr -subj "/CN=dkim01/O=customer"`
    2. Enter `openssl x509 -days 3650 -signkey private.pem -in tmp.csr -req -out "tmp_certificate.pem"`
    3. Enter `openssl pkcs12 -export -inkey private.pem -in "tmp_certificate.pem" -out private_key.p12 -password pass:12345`
3. Export the public key to be published in the DNS. Enter `openssl rsa -in private.pem -pubout -out public.pem`

#### See Also

- [Configure DKIM for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_deploy_dkim.htm&release=264.0.0&type=5 "Major email providers, including Google, Microsoft, and Yahoo, now require DomainKeys Identified Mail (DKIM) authentication. Configuring DKIM is essential to ensure that your emails reach customer inboxes and aren’t rejected or flagged as spam. Configure DKIM to verify that the emails come from the domain that they claim to be from.")