WireGuard
WireGuard
[edit]Key Management (wg)
[edit]The `wg` utility provides everything required to generate and manage WireGuard key material.
Generate a Private Key
[edit]Generate a new private key:
wg genkey
Save it to a file:
wg genkey > private.key
Derive a Public Key
[edit]A WireGuard public key is always derived from the private key.
Generate the corresponding public key:
wg pubkey < private.key
Save it:
wg pubkey < private.key > public.key
Generate a Key Pair
[edit]Generate both the private and public key in one command:
wg genkey | tee private.key | wg pubkey > public.key
Generate a Preshared Key (PSK)
[edit]Generate a new preshared key:
wg genpsk
Save it:
wg genpsk > psk.key
Notes
[edit]- Every WireGuard interface has a single private/public key pair.
- Every peer has its own public key.
- A PresharedKey is optional and unique per peer.
- Public keys are deterministic and can always be regenerated from the private key.
- Only the private key must remain secret.
- Public keys are safe to share.
- PSKs must be configured identically on both peers.