Updated installation

installation.md

@@ -25,4 +25,22 @@ Ensure that you’ve set up your project to [autoload Composer-installed package
 
 Depending on [which grant]() you are implementing you will need to implement a number of repository interfaces. Each grant documentation page lists which repositories are required, and each repository interface has it's own documentation page. 
 
-The repositories are expected to return (on success) instances of [entity interfaces](https://github.com/thephpleague/oauth2-server/tree/V5-WIP/src/Entities/Interfaces); to make integration with your existing entities and models as easy as possible though, all required methods have been implemented as traits that you can use.
+The repositories are expected to return (on success) instances of [entity interfaces](https://github.com/thephpleague/oauth2-server/tree/V5-WIP/src/Entities/Interfaces); to make integration with your existing entities and models as easy as possible though, all required methods have been implemented as traits that you can use.
+
+## Generating public and private keys
+
+To generate the private key run this command on the terminal:
+
+{% highlight shell %}
+openssl genrsa -out private.key 1024
+{% endhighlight %}
+
+then extract the public key from the private key:
+
+{% highlight shell %}
+openssl rsa -in private.key -pubout > public.key
+{% endhighlight %}
+ 
+The private key must be kept secret (i.e. out of the web-root of the authorization server). The authorization server also requires the public key.
+
+The public key should be distributed to any services (for example resource servers) that validate access tokens.