Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working with Apache2 and Passenger for a Rails project. I would like to create a self-signed SSL Certificate for testing purposes.

sudo openssl rsa -des3 -in server.key -out

When i enter the above command, it says

writing RSA key
Enter PEM pass phrase:

If i do not enter the pass phrse, im getting the below error

unable to write key
3079317228:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:869:Yo
u must type in 4 to 1024 characters
3079317228:error:0906406D:PEM routines:PEM_def_callback:problems getting passwor
3079317228:error:0906906F:PEM routines:PEM_ASN1_write_bio:read key:pem_lib.c:382

Is it possible to generate a RSA key without giving pass phrase, since I am not sure how the /etc/init.d/httpd script will start the HTTP server without human intervention (i.e. If I give a 4 character pass phrase, it expects me to provide this while starting the Apache HTTP server).

share|improve this question
Your command line tells openssl to encrypt an existing key. That sounds like something other than what you want. – David Schwartz Mar 5 '12 at 8:41
up vote 33 down vote accepted

If you are generating a self signed cert, you can do both the key and cert in one command like so:

openssl req  -nodes -new -x509  -keyout server.key -out server.cert

Oh, and what @MadHatter said in his answer about omitting the -des3 flag.

share|improve this answer

Leave off the -des3 flag, which is an instruction to openssl to encrypt (which, incidentally, isn't a new key at all - it's exactly the same as server.key, only with the passphrase changed/stripped off).

share|improve this answer

The openssl req command from the answer by @Tom H is correct to create a self-signed certificate in server.cert incl. a password-less RSA private key in server.key:

openssl req -nodes -new -x509 -keyout server.key -out server.cert

Here is how it works. Omitting -des3 as in the answer by @MadHatter is not enough in this case to create a private key without passphrase. It is enough for this purpose in the openssl rsa ("convert a private key") command referred to by @MadHatter and the openssl genrsa ("create a private key") command. Just not for for the openssl req command here. We additionally need -nodes ("No DES encryption of server.key please!").

share|improve this answer

Just run it again through openssl

first generate the key with the passphrase

then openssl rsa -in server.key -out server.key

share|improve this answer
This is not working on ubuntu 16.04 – sweetfa May 9 at 20:19

Use the -nodes parameter, if this option is specified then the private key will not be encrypted, e.g.:

openssl \
    req \
    -nodes \
    -newkey rsa:2048 \
    -keyout \
    -out \
    -subj "/C=DE/ST=NRW/L=Berlin/O=My Inc/OU=DevOps/"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.