1

I've tried converting a PEM-encoded key to DER format, and it appears the password is stripped regardless of the -passout argument.

Example:

openssl rsa -in tmp.pem -outform DER -out tmp.der -passin pass:foo -passout pass:bar -des3

The resulting key appears no longer password-protected, so I am assuming that DER format does not support a password - is that correct?

What alternative way is there to store this in a compact, binary form, and keep the password-protection?

Tim
  • 584
  • 2
  • 9
  • 20

1 Answers1

1

In fact, the -passout is ignored. Last sentence of the help for -des3 in the man-page is

These options can only be used with PEM format output files.

OpenSSL's utilities just don't deal with keys in non-PEM format.

For the length of a key, why do you care whether or not base64 has made it 1/3 longer? For most file-systems, this will still be less than one block, so there will be no actual change in the amount of disk-space used.

Phil P
  • 3,080
  • 1
  • 16
  • 19