Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A while ago I created a key with openssl genrsa -aes256 4096 > server.key. The process prompts for a pass phrase. I would now like to change that pass phrase, is that possible?

share|improve this question
I am certain it is possible, not sure about the syntax off the top of my head. I spend a fair amount of time reading the man page last time I needed to do this. – Zoredache Feb 12 '13 at 22:41
up vote 5 down vote accepted
openssl rsa -des3 -in server.key -out newserver.key
share|improve this answer
The syntax is correct, but there really isn't a good reason to keep using Triple DES. It becomes extremely vulnerable with certain passphrase lengths. – Dennis Feb 13 '13 at 1:42
@Dennis - How well supported are the alternative cyphers, and how how big a problem is it really (ie if someone can get physically get the private key surely you have bigger problems). You are probably technically right in what you say, but I've never seen an SSL cert provider suggest anything else, and wonder why) – davidgo Feb 13 '13 at 3:47
Triple DES was an emergency drop-in replacement for DES when the first brute-force attack was successful. In November 2001, it was superseded by AES (Advanced Encryption Standard); AES is faster, provides more security for keys of the same length and supports longer keys. Support for AES should be at least as good as support for Triple DES by now. – Dennis Feb 13 '13 at 10:06
so is openssl rsa -aes -in server.key -out newserver.key the recommended method for changing pass phrases then? – Matt Feb 13 '13 at 23:45
looks like it would be openssl rsa -aes256 -in server.key -out newserver.key. You can also use -aes192 or -aes128. – Mafuba Feb 8 '14 at 16:59

Use AES, e.g. AES256 instead of Triple DES:

openssl rsa -aes256 -in server.key -out newserver.key
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .