bad decrypt

What the error actually means #

Decryption did not fail early. OpenSSL read the whole ciphertext, decrypted it, and then checked the padding on the final block — which is the last step, and the first point at which a wrong key becomes detectable at all.

That is the useful part of the message: the key OpenSSL derived from your passphrase is not the key the data was encrypted with. Either the passphrase is different, or the derivation is.

Case 1 — an encrypted private key #

The file begins with a BEGIN ENCRYPTED PRIVATE KEY line, or with BEGIN RSA PRIVATE KEY followed by a Proc-Type and DEK-Info header. Test the passphrase without touching the file:

openssl pkey -in encrypted.key -passin pass:testpass -noout

Silence and a zero exit status mean the passphrase is right. bad decrypt means it is not, and there is no way around that — the check is the encryption doing its job.

Once it opens, remove the passphrase or change it:

openssl pkey -in encrypted.key -passin pass:testpass \
-aes256 -passout pass:newpassphrase -out rekeyed.key

Case 2 — a file encrypted with openssl enc #

This is the version-skew case, and the symptom is distinctive: the passphrase is definitely correct, the file used to open, and something on the machine changed.

OpenSSL 1.0.x derived the encryption key from the passphrase using MD5. OpenSSL 1.1.0 changed that default to SHA-256. The passphrase is unchanged; the key derived from it is completely different, so the padding check fails and you get bad decrypt.

openssl enc -d -aes-256-cbc -md md5 -in secret.enc -out secret.txt

Once it opens, re-encrypt it properly. -pbkdf2 replaces the legacy derivation with PBKDF2 and is the reason OpenSSL 3 prints a deprecation warning when it is absent:

openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt \
-in certificate.crt -out certificate.enc -pass pass:testpass
openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 \
-in certificate.enc -out certificate.dec -pass pass:testpass

Every option must match on both sides #

enc stores the salt in the file but nothing else. Cipher, digest, iteration count and whether PBKDF2 was used are all remembered by you, not by the file, and any one of them being different produces this identical error:

head -c 8 certificate.enc | od -c | head -1

What this error is not #

Nor is it a PEM parsing failure. A file whose armour is malformed fails much earlier, with PEM routines::no start line — that error means OpenSSL never found data to decrypt, where this one means it decrypted and the result was wrong.