Change an RSA Key Passphrase with OpenSSL

The openssl rsa command processes RSA private keys. Its most common use is re-encrypting a key with a new passphrase — or stripping the passphrase entirely.

Change the passphrase

openssl rsa -des3 -in $OLD_KEY -out $NEW_KEY

This prompts for the old passphrase, then encrypts the key with a new one using DES3. (For modern AES encryption, use -aes256 instead of -des3.)

Remove the passphrase

openssl rsa -in $OLD_KEY -out $NEW_KEY

Prompts once for the current passphrase, then writes the key unencrypted.

Verify the passphrase

openssl rsa -check -in $KEY_FILE

Reads the key, prompts for the passphrase, and reports whether the key is valid and consistent.

Operational notes

• ssh-keygen -p -f $KEY is the native OpenSSH way to change a passphrase in place; openssl rsa is useful when you need to convert formats or script the change.
• Unencrypted keys (-out without an encryption flag) are a liability. If you must strip a passphrase for automation, protect the file with filesystem permissions and consider an encrypted filesystem or a secrets manager.

Related

• gpg-key-with-ssh-support — the GPG-based alternative to standalone SSH keys
• openssl-file-encryption — encrypting arbitrary files with OpenSSL
• ssh — where these keys are actually used

Sources

• openbsd-openssl-man
• rsa(1): RSA key processing tool - Linux man page