OpenSSL • Generation & Keys
How to Remove Passphrase from an RSA Private Key for NGINX/Apache
When an RSA private key is encrypted with AES or DES, web servers prompt for the passphrase every time the process starts or reloads. Removing the passphrase creates an unencrypted key that NGINX, Apache, and Docker containers can read unattended.
Remove Passphrase from Key Command
Caution • Private Key Handling / Decryption
openssl rsa -in encrypted.key -out decrypted.keyCustomize:
Domain:
Cert File:
OpenSSL Flags & Options Explained
-in encrypted.keySource passphrase-protected private key-out decrypted.keyDestination unencrypted private keyExecution Steps & Verification
1Decrypt the key
Run the decryption command and enter the passphrase when prompted:
openssl rsa -in encrypted.key -out decrypted.key2Secure the unencrypted key file
Restrict file access permissions to owner read/write:
chmod 600 decrypted.key3Verify header difference
Check that DEK-Info header is gone and file begins with standard `BEGIN RSA PRIVATE KEY`:
head -n 5 decrypted.keyCommon Security Pitfalls & Solutions
- Ensure the server hosting the decrypted key has strict file permissions, as anyone with read access can impersonate the certificate.
Prerequisites & Environment
- Encrypted private key and its current passphrase.
Frequently Asked Questions About Remove Passphrase from Key
Frequently Asked Questions
Frequently Asked Questions
Everything you need to know regarding specifications, syntax, and security best practices.
Run: `openssl rsa -aes256 -in decrypted.key -out encrypted.key` and enter your desired new passphrase.
Related OpenSSL & Security Commands
View All RecipesGeneration & Keys
How to Generate a Self-Signed SSL Certificate with OpenSSL
reqGuide →
Verification & Inspection
How to Check SSL Certificate Expiration Date from Domain or File
s_clientGuide →
Verification & Inspection
How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)
x509Guide →
Verification & Inspection
How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)
x509Guide →
Generation & Keys
How to Generate a Certificate Signing Request (CSR) with SAN
reqGuide →
Format Conversions
How to Convert PFX / PKCS#12 to PEM Certificate and Private Key
pkcs12Guide →