A while ago I created a key with openssl genrsa -aes256 4096 > server.key. The process prompts for a pass phrase. I would now like to change that pass phrase, is that possible?

  • I am certain it is possible, not sure about the syntax off the top of my head. I spend a fair amount of time reading the man page last time I needed to do this. – Zoredache Feb 12 '13 at 22:41

Use AES, e.g. AES256 instead of Triple DES:

openssl rsa -aes256 -in server.key -out newserver.key
| improve this answer | |
  • We need the original passphrase for this to work. If that is lost, is there a way to reset this? – Jordan Oct 18 '18 at 16:44
  • 1
    @Jordan generate a new key/cert pair and distribute them. If there was a way to "reset" the key passphrase, there's nothing to prevent someone else from doing so and stealing the plaintext key. – Nick T Aug 2 '19 at 21:30
openssl rsa -des3 -in server.key -out newserver.key
| improve this answer | |
  • The syntax is correct, but there really isn't a good reason to keep using Triple DES. It becomes extremely vulnerable with certain passphrase lengths. – Dennis Feb 13 '13 at 1:42
  • @Dennis - How well supported are the alternative cyphers, and how how big a problem is it really (ie if someone can get physically get the private key surely you have bigger problems). You are probably technically right in what you say, but I've never seen an SSL cert provider suggest anything else, and wonder why) – davidgo Feb 13 '13 at 3:47
  • Triple DES was an emergency drop-in replacement for DES when the first brute-force attack was successful. In November 2001, it was superseded by AES (Advanced Encryption Standard); AES is faster, provides more security for keys of the same length and supports longer keys. Support for AES should be at least as good as support for Triple DES by now. – Dennis Feb 13 '13 at 10:06
  • 2
    so is openssl rsa -aes -in server.key -out newserver.key the recommended method for changing pass phrases then? – Matt Feb 13 '13 at 23:45
  • 7
    looks like it would be openssl rsa -aes256 -in server.key -out newserver.key. You can also use -aes192 or -aes128. – Mafuba Feb 8 '14 at 16:59

If you have ssh-keygen installed, this is simpler :

ssh-keygen -p -f server.key

| improve this answer | |
  • 4
    Welcome to Super User! On this Q&A site we try to provide good answers to questions people ask. Part of writing a good answer is providing context for the proposed solution. Please edit your answer and explain why your solution works, and what, specifically, it does. – cascer1 Oct 17 '16 at 12:09
  • 2
    I do not see the point of the previous comment. I have just checked that this answer is useful and actually let change the password of an openssl key in-place without the need to save into a new file. – Seki Jun 6 '18 at 11:53
  • I find this solution better that the others, as you don't have to remember or introspect the key file to figure out the encryption algorithm: ssh-keygen will do that for you. – ob-ivan Dec 14 '18 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.