• -rand file-name [:file-name...]
  Specify any file to be used for random number generation. You must specify an appropriate file whose size is large enough for the random number generation (for example, C:\WINNT\NOTEPAD.EXE). In Windows, you can specify only one file name. Multiple file names cannot be specified.
  
• [-des|-des3]
  Specify the encryption type when encrypting the private key. If you specify this parameter, you will be requested to enter a password when creating the private key. The password must be no more than 64 characters long.
  When creating the Certificate Signing Request (CSR) (see 5.2.2 Creating a Certificate Signing Request (CSR) (certutil reqgen command)) and starting the Web server, you will also be requested to enter the password. Note that you can skip the password entry for Web server startup (see 5.4 Using the server private key with a password). If -des is specified, the Data Encryption Standard (DES) is selected as the encryption type. If -des3 is specified, Triple DES is selected. This parameter does not affect the encryption type used in the communication between the Web server and the Web browser.
  
• -out key-file
  Specify the file to which the Web server private key is output.
  
• -bits {512|1024|2048|4096}
  Specify the bit length of the Web server private key.
  

To create the httpsdkey.pem Web server private key:

 
keygen -rand file1:file2:file3:file4:file5 -out httpsdkey.pem -bits 1024
 

file1, file2, file3, file4 and file5: Arbitrary files