I'm working with Apache2 and Passenger for a Rails project. I would like to create a self-signed SSL Certificate for testing purposes.

sudo openssl rsa -des3 -in server.key -out server.key.new

When i enter the above command, it says

writing RSA key
Enter PEM pass phrase:

If i do not enter the pass phrse, im getting the below error

unable to write key
3079317228:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:869:Yo
u must type in 4 to 1024 characters
3079317228:error:0906406D:PEM routines:PEM_def_callback:problems getting passwor
3079317228:error:0906906F:PEM routines:PEM_ASN1_write_bio:read key:pem_lib.c:382

Is it possible to generate a RSA key without giving pass phrase, since I am not sure how the /etc/init.d/httpd script will start the HTTP server without human intervention (i.e. If I give a 4 character pass phrase, it expects me to provide this while starting the Apache HTTP server).

  • 7
    Your command line tells openssl to encrypt an existing key. That sounds like something other than what you want. Mar 5, 2012 at 8:41
  • 1
    Apache httpd can be configured to obtain the privatekey passphrase(s) noninteractively; see the doc for mod_ssl, or in many cases comments in the provided/packaged config file(s). However, this is usually no more secure than just leaving the privatekey unencrypted, which is simpler. Apr 25, 2018 at 12:46

8 Answers 8


If you are generating a self signed cert, you can do both the key and cert in one command like so:

openssl req  -nodes -new -x509  -keyout server.key -out server.cert

Oh, and what @MadHatter said in his answer about omitting the -des3 flag.

  • 32
    The nodes directive is why I'm here. (No DES encryption of private key)
    – jorfus
    Jan 24, 2017 at 23:15

Leave off the -des3 flag, which is an instruction to openssl to encrypt server.key.new (which, incidentally, isn't a new key at all - it's exactly the same as server.key, only with the passphrase changed/stripped off).


The openssl req command from the answer by @Tom H is correct to create a self-signed certificate in server.cert incl. a password-less RSA private key in server.key:

openssl req -nodes -new -x509 -keyout server.key -out server.cert

Here is how it works. Omitting -des3 as in the answer by @MadHatter is not enough in this case to create a private key without passphrase. It is enough for this purpose in the openssl rsa ("convert a private key") command referred to by @MadHatter and the openssl genrsa ("create a private key") command. Just not for for the openssl req command here. We additionally need -nodes ("No DES encryption of server.key please!").


Use the -nodes parameter, if this option is specified then the private key will not be encrypted, e.g.:

openssl \
    req \
    -nodes \
    -newkey rsa:2048 \
    -keyout www.example.com.key \
    -out www.example.com.csr \
    -subj "/C=DE/ST=NRW/L=Berlin/O=My Inc/OU=DevOps/CN=www.example.com/emailAddress=dev@www.example.com"

Just run it again through openssl

first generate the key with the passphrase

then openssl rsa -in server.key -out server.key

  • 1
    This is not working on ubuntu 16.04
    – sweetfa
    May 9, 2016 at 20:19
  • 3
    I downvoted because this answer is not what was asked, also the command requires an input and doesn't generate a key.
    – Don
    Oct 11, 2016 at 13:37
  • 1
    The user already demonstrated they know how to generate a key. This answer builds on that knowledge, and I suggest to take the newly generated key and pass it again through openssl Hence achieving the goal of what was asked: generating a key without a pass phrase.
    – darethas
    Oct 11, 2016 at 14:19
  • Works for me, openssl on Windows 10 from GitBash. Thanks for info.
    – Green
    May 14, 2017 at 21:11
  • cool it worked for my self signed cert
    – luky
    Aug 13, 2020 at 12:31

Adding '-nodes' to the 'openssl req' allows a unencrypted (no pass phrase) private key to be generated from the 'openssl req' command

  • 2
    This is exactly the right answer. The -nodes flag means "No DES": ie., no encrypting the private key. Jul 25, 2020 at 18:19

Use the next command to generate password-less private key file with NO encryption. The last parameter is the size of the private key.

openssl genrsa -out my-passless-private.key 4096
  • 1
    This is NOT password-less. It is completely and entirely password-ful. Apr 25, 2018 at 12:48
  • I was experimenting with position of the parameters. It is now OK. I changed the places of last two parameters and tested the command.
    – nix
    Apr 25, 2018 at 13:47
  • Now it produces an unencrypted file. Options after the (only) positional argument are ignored. Look at the file; it's not encrypted. Replace 4096 -des3 with 4096 -sillywombat and it still works and produces the same format, still unencrypted (but a different key value of course). There is no way to have a passwordless encrypted privatekey file, and correct solutions for a passwordless unencrypted file were given six years ago. Apr 26, 2018 at 12:58
  • 1
    You are right. @dave_thompson_085. The last parameter doesn't any affect on the command. I updated my answer. It generate none encrypted base64 encoded and not password protected private key file.
    – nix
    Apr 26, 2018 at 14:16

To generate PEM certificate without passphrase:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 10000 -nodes

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.