Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm working with Apache2 and Passenger for a Rails project. I would like to create a self-signed SSL Certificate for testing purposes.

sudo openssl rsa -des3 -in server.key -out server.key.new

When i enter the above command, it says

writing RSA key
Enter PEM pass phrase:

If i do not enter the pass phrse, im getting the below error

unable to write key
3079317228:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:869:Yo
u must type in 4 to 1024 characters
3079317228:error:0906406D:PEM routines:PEM_def_callback:problems getting passwor
3079317228:error:0906906F:PEM routines:PEM_ASN1_write_bio:read key:pem_lib.c:382

Is it possible to generate a RSA key without giving pass phrase, since I am not sure how the /etc/init.d/httpd script will start the HTTP server without human intervention (i.e. If I give a 4 character pass phrase, it expects me to provide this while starting the Apache HTTP server).

share|improve this question
Your command line tells openssl to encrypt an existing key. That sounds like something other than what you want. –  David Schwartz Mar 5 '12 at 8:41

4 Answers 4

up vote 17 down vote accepted

if you are generating a self signed cert, you can do both the key and cert in one command like so;

openssl req  -nodes -new -x509  -keyout server.key \
    -out server.cert 

Oh, and what MadHatter said about omitting the 3des

share|improve this answer

Leave off the -des3 flag, which is an instruction to openssl to encrypt server.key.new (which, incidentally, isn't a new key at all - it's exactly the same as server.key, only with the passphrase changed/stripped off).

share|improve this answer

The openssl req command proposed by @Tom H is correct to create a self-signed certificate incl. password-less private key:

openssl req -nodes -new -x509 -keyout server.key -out server.cert

But: the trick to create a private key without passphrase is -nodes in the command ("No DES encryption please!"). Omitting -des3 as proposed by @MadHatter is not enough!

(Details: Omitting -des3 is enough for the openssl genrsa ("create a private key") and openssl rsa ("convert a private key") commands. Just not for for openssl req.)

share|improve this answer

Just run it again through openssl

first generate the key with the passphrase

then openssl rsa -in server.key -out server.key

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.