: Can I skip the PEM pass phrase question when I restart the webserver? After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation

@Marchetta884

As suggested, I asked the question on ServerFault: serverfault.com/questions/161768/restart-webserver-without-entering-a-password
But the short answer is:

Backup your key:

> cp server.key server.key.org


Strip out the password:

> openssl rsa -in server.key.org -out server.key

[enter the passphrase]


The newly created server.key file has no more passphrase in it and the webservers start without needing a password.

Another option is to use Apaches SSLPassPhraseDialog option to automatically answer the SSL pass phrase question.

Disclaimer: If the private key is no longer encrypted, it is critical that this file only be readable by the root user! If your system is ever compromised and a third party obtains your unencrypted private key, the corresponding certificate will need to be revoked.

Vote Up Vote Down

@BetL925

Yes, this is a common thing to do. If the pass phrase would be stored on disk, an attacker could take over the certificate.

Off course you could remove the pass phrase from the certificate, but I would not recommend that! Also other technical solutions exists with external peripherals.

Vote Up Vote Down