CertGuru

Remove or change a private key passphrase

To remove a passphrase from a private key, run `openssl pkey -in encrypted.key -out plain.key` and enter the current passphrase when prompted. To add one, run `openssl pkey -in plain.key -aes256 -out encrypted.key`. Web servers generally need the unencrypted form, because they cannot answer a passphrase prompt during an unattended restart — protect the key with `chmod 600` instead. `openssl pkey` works for RSA, EC and Ed25519 keys alike, unlike the older `openssl rsa`.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

Remove a passphrase #

Write an unencrypted copy
openssl pkey -in encrypted.key -out plain.key

OpenSSL prompts for the current passphrase. Then lock the result down immediately:

chmod 600 plain.key

Add a passphrase #

Encrypt with AES-256
openssl pkey -in plain.key -aes256 -out encrypted.key

Change an existing passphrase #

There is no direct “change” operation — decrypt and re-encrypt in one pipeline:

openssl pkey -in encrypted.key -aes256 -out new-encrypted.key

You are prompted for the old passphrase to read the file and the new one to write it.

Non-interactive #

Remove a passphrase in a script
openssl pkey -in encrypted.key -passin file:/run/secrets/key-passphrase -out plain.key
Add one, reading from the environment
openssl pkey -in plain.key -aes256 -passout env:KEY_PASSPHRASE -out encrypted.key

When to keep the passphrase #

Key Passphrase? Why
Web server TLS key No The server must restart without a human present
CA private key Yes Handled by a person, and catastrophic if leaked
Key on a laptop or workstation Yes Disk theft is a realistic risk
Key in a secrets manager No The manager provides the protection
Key in a container image Neither — do not do this Images are copied and shared far more than people expect

nginx with an encrypted key #

If you must keep the passphrase, nginx can read it from a file:

ssl_certificate      /etc/ssl/certs/fullchain.crt;
ssl_certificate_key  /etc/ssl/private/encrypted.key;
ssl_password_file    /etc/ssl/private/key-passphrase;

The older subcommands #

openssl rsa does the same for RSA keys and is what most older documentation shows:

openssl rsa -in encrypted.key -out plain.key

Confirm nothing changed but the encryption #

Same key, so the public keys must match
openssl pkey -in encrypted.key -pubout | openssl sha256
openssl pkey -in plain.key -pubout | openssl sha256

Frequently asked questions

Is it safe to remove the passphrase?
It is a trade-off rather than a mistake. Removing it means file permissions are the only protection, which is what nearly every production web server does — because the alternative is a service that cannot restart without a human present. Keep passphrases on keys people handle, such as a CA key.
How do I know if my key has a passphrase?
Read the first line. BEGIN ENCRYPTED PRIVATE KEY is PKCS#8 encryption. An older key may say BEGIN RSA PRIVATE KEY with a Proc-Type: 4,ENCRYPTED line beneath it. BEGIN PRIVATE KEY alone means unencrypted.
I have forgotten the passphrase — can I recover the key?
No. The key material is encrypted with a key derived from the passphrase and there is no bypass. Generate a new key and have the certificate reissued.
Can nginx use an encrypted key?
Yes, with ssl_password_file pointing at a file containing the passphrase. That stores the passphrase in plaintext next to the key, so the security gain is close to zero — but it does let a restart proceed unattended.

References

Related pages