Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
stop apache from asking for SSL password each restart

When I created my SSL certificate I used a pass phrase in the key. Whenever I restart my web server (Apache or Nginx) they ask for a password:

Apache:

Some of your private key files are encrypted for security reasons. In order to read them you have to provide the pass phrases.

Server www.example:443 (RSA)

Enter pass phrase:

Nginx:

Starting nginx: Enter PEM pass phrase:

Entering the password each time is fast getting annoying and I'm worried about downtime when the machine is next rebooted.

Is there a way to automatically provide the PEM pass phrase when the webserver is restarted? or do I have to get the SSL certificate re-issued using a key where the pass phrase has been removed?

If I remove the pass phrase, what are the security implications? Is it anything to worry about?

share|improve this question

marked as duplicate by Chris S, joschi, Warner, splattne Jul 21 '10 at 5:46

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

See Warner's Answer to almost the exact same question a day or two ago.

share|improve this answer
    
Thanks for the link, sorry I didn't spot it. –  Tom Jul 19 '10 at 13:08

Answering each question in turn:

1) Is there a way to automatically provide the PEM pass phrase when the webserver is restarted?

Apache has the SSLPassPhraseDialog to automatically answer the SSL pass phrase question.

2) do I have to get the SSL certificate re-issued using a key where the pass phrase has been removed?

The pass prase can be removed from the key without needing to get the certificate re-issued. The key is your secret and you can do anything you want with it including making it unsecure:

> cp server.key server.key.org
> openssl rsa -in server.key.org -out server.key
[enter the passphrase]

3) If I remove the pass phrase, what are the security implications? Is it anything to worry about?

Yes, if the private key is no longer encrypted, it is critical that this file only be readable by the root user. If your system is ever compromised and a third party obtains your unencrypted private key, the corresponding certificate will need to be revoked immediately or the attack could put up a website pretending to be yours.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.