Re: [PATCH] mod_ssl: add directive to read passphrase from file for encrypted private key

Thanks, Christian!


On 12/1/2025 3:28 AM, Christian Nageby wrote:
> Hi all,
>
> This patch introduces a new directive to mod_ssl that allows 
> administrators to specify a file from which the passphrase for an 
> encrypted private key will be read at startup.
>
> This provides a simple, non-interactive mechanism for supplying
> key passphrases in automated deployments while preserving existing 
> behavior.
>
> If the configured file is missing, unreadable, or contains an incorrect
> passphrase, mod_ssl gracefully falls back to its normal key-loading 
> mechanism. When the directive is not configured, there is no change in 
> behavior.

This seems like a perfectly sensible thing to support, but I wonder if 
we'd need a new directive? What do you think about adding this as an 
option for the existing SSLPassphraseDialog directive? It would serve to 
keep the gathering of such passphrases in one place. I would guess we 
could use either a raw path (/path/to/file.txt) or a prefix like we 
already have (file:/path/to/file.txt).


>
> Rationale:
> - Enables automation scenarios where interactive passphrase entry is 
> not feasible.
> - Maintains full backward compatibility: no behavior change unless the 
> directive is explicitly used.
>
> Verified:
>  * Correct passphrase in file → httpd starts and loads key normally.
>  * Missing passphrase file → httpd fails to start.
>  * Invlid passphrase in file → httpd defaults to prompt for the 
> passphrase.
>  * Both encrypted and unencrypted private keys tested.
>
> Example configuration to use a password file:
>
>    SSLEngine on
>    SSLCertificateFile /etc/pki/tls/certs/cert.pem
>    SSLCertificateKeyFile /etc/pki/tls/private/key.pem
>    SSLCertificateKeyPasswordFile /etc/pki/tls/private/key.pem.pass
>
> Patch attached as mod_ssl.patch
>
> Documentation for the new directive will be submitted separately or 
> included once the directive name and semantics are agreed on.
>
> Feedback welcome.
>
> Regards,
> Christian

-- 
Daniel Ruggeri