I'm trying to remove the password on a private key. Doing it by hand is simple, I run this command and enter the password : openssl rsa <newkey.pem > newkey-no-password.pem

I'm trying to do this in an expect script, so that I don't have to actually type the password. Here is the code I wrote:

#!/usr/bin/expect -f
set PASSWORD myPassword

spawn openssl rsa <newkey.pem > newkey-no-pass.pem
expect "Enter pass phrase:"
send "$PASSWORD\r"
expect eof

And here is the output I get when running the script:

[me@mymachine]# ./test.exp
spawn openssl rsa <newkey.pem > newkey-no-pass.pem
unknown option <newkey.pem
rsa [options] <infile >outfile
... all the options for rsa command ...

I tried putting the <newkey.pem between ' or ", to no avail.

What am I doing wrong and how can I fix this problem?


I think the spawn command does not parse shell redirections <. You can make it work by passing it through a shell with sh -c:

#!/usr/bin/expect -f
set PASSWORD myPassword

spawn sh -c "openssl rsa <newkey.pem > newkey-no-pass.pem"
expect "Enter pass phrase:"
send "$PASSWORD\r"
expect eof

It works for me:

# expect -f kkf
spawn sh -c openssl rsa <newkey.pem > newkey-no-pass.pem
Enter pass phrase:myPassword
writing RSA key
  • Alternatively you can give openssl rsa options -in file and -out file instead of using redirections. For that matter, you can just give option -passin pass:mypasswd and it won't prompt at all; however, this will usually be visible, very briefly, to anyone who runs ps or reads /proc/n/cmdline or similar. – dave_thompson_085 Jun 25 '14 at 13:03

I use this to extract private key and remove password from a pkcs12 file :

openssl pkcs12 -in myFile.p12 -nocerts -out myFile.priv.password.pem -passin pass:SomePassword -passout pass:SomeOtherPassword

openssl pkcs8 -topk8 -nocrypt -inform pem -in myFile.priv.password.pem -passin pass:SomeOtherPassword -outform pem -out myFile.priv.pem

Some my guess is : this should work for you :

openssl rsa -in newkey.pem -out newkey-no-pass.pem -passin pass:SomePassword

If you don't want the password on the command line, you can use a file (with restricted access) :

openssl rsa -in newkey.pem -out newkey-no-pass.pem -passin file:PasswordFile.txt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.