Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A while ago I created a key with openssl genrsa -aes256 4096 > server.key. The process prompts for a pass phrase. I would now like to change that pass phrase, is that possible?

share|improve this question
    
I am certain it is possible, not sure about the syntax off the top of my head. I spend a fair amount of time reading the man page last time I needed to do this. –  Zoredache Feb 12 '13 at 22:41

1 Answer 1

up vote 3 down vote accepted
openssl rsa -des3 -in server.key -out newserver.key
share|improve this answer
    
The syntax is correct, but there really isn't a good reason to keep using Triple DES. It becomes extremely vulnerable with certain passphrase lengths. –  Dennis Feb 13 '13 at 1:42
    
@Dennis - How well supported are the alternative cyphers, and how how big a problem is it really (ie if someone can get physically get the private key surely you have bigger problems). You are probably technically right in what you say, but I've never seen an SSL cert provider suggest anything else, and wonder why) –  davidgo Feb 13 '13 at 3:47
    
Triple DES was an emergency drop-in replacement for DES when the first brute-force attack was successful. In November 2001, it was superseded by AES (Advanced Encryption Standard); AES is faster, provides more security for keys of the same length and supports longer keys. Support for AES should be at least as good as support for Triple DES by now. –  Dennis Feb 13 '13 at 10:06
2  
so is openssl rsa -aes -in server.key -out newserver.key the recommended method for changing pass phrases then? –  Matt Ball Feb 13 '13 at 23:45
2  
looks like it would be openssl rsa -aes256 -in server.key -out newserver.key. You can also use -aes192 or -aes128. –  Mafuba Feb 8 at 16:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.