How to encrypt a private key using OpenSSL

Private-key files often move through backups, handoffs, certificate renewals, and manual unlock workflows after they are generated. An unencrypted PEM key is exposed as soon as another user, ticket attachment, or copied archive can read it, so a passphrase-protected copy gives the key another layer of protection without changing the key pair.

The openssl pkey command reads private keys and writes a new key file. Adding an output cipher such as -aes256 encrypts the new PKCS#8 private-key file and prompts twice for the output passphrase unless a passphrase source is supplied with -passout.

Keep the input and output paths different. Some daemons cannot unlock encrypted keys during unattended startup, so use encrypted copies for storage, transfer, or workflows where an operator or secret store can provide the passphrase, and keep service-start keys protected by file permissions when automation cannot unlock them.

Steps to encrypt an OpenSSL private key:

Move to the private directory that contains the unencrypted key.
```
$ cd ~/tls-keys
```
Set a restrictive file-creation mask for new key files in this shell session.
```
$ umask 077
```
Files created after this command are not readable by group or other users unless a later command changes the mode.
Confirm OpenSSL can parse the source private key before creating the encrypted copy.
```
$ openssl pkey -in server.key -check -noout
Key is valid
```
Write an encrypted copy with a different output filename.
```
$ openssl pkey -aes256 -in server.key -out server-encrypted.key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
```
Do not use the same path for -in and -out. OpenSSL can replace the output file contents while writing, so a failed or interrupted command can damage the only copy of the key.

For unattended runs, use a protected passphrase source such as -passout file:key.pass instead of putting the passphrase after pass: on the command line.
Restrict the encrypted private key file.
```
$ chmod 600 server-encrypted.key
```
Verify that the encrypted key requires the passphrase and still parses.
```
$ openssl pkey -in server-encrypted.key -check -noout
Enter pass phrase for server-encrypted.key:
Key is valid
```
Key is valid means the passphrase decrypted the file and OpenSSL accepted the private-key structure.
Try the encrypted copy with an intentionally wrong passphrase when audit evidence needs to show the lock is active.
```
$ openssl pkey -in server-encrypted.key -check -noout
Enter pass phrase for server-encrypted.key:
Could not find private key of key from server-encrypted.key
##### snipped #####
maybe wrong password
```
A wrong passphrase failure shows the copied key is no longer readable without the correct secret.
Confirm the original unencrypted key still parses after writing the encrypted copy.
```
$ openssl pkey -in server.key -check -noout
Key is valid
```
Delete or archive the unencrypted original only after the encrypted copy has been accepted by the service, appliance, secret store, or handoff process that will use it.