OpenVPN Asks for Key Passphrase on an Unencrypted Key

Verify Key Encryption Status

The most common cause is that the .key file itself contains a PEM header indicating encryption. You can verify this by inspecting the file content using a text editor or command-line tool. Open the private key file and look at the first few lines.

• If you see Proc-Type: 4,ENCRYPTED, the key is definitely encrypted.
• If you see DEK-Info shortly after, it confirms encryption metadata is present.
• A truly unencrypted key will start directly with -----BEGIN RSA PRIVATE KEY----- without those headers.

Many users generate keys using tools like EasyRSA or OpenSSL without realizing they are prompted for a passphrase during creation. If you used openssl genrsa -des3, the key is encrypted by default. Even if you think you left it blank, some GUI wrappers may have inserted a dummy password or the system defaulted to encryption.

Check Configuration File Directives

Even with an unencrypted key, OpenVPN might ask for a passphrase if the configuration file instructs it to do so. Review your client configuration file (usually client.conf or client.ovpn) for specific directives.

1. Look for the askpass directive. While not a standard core directive in all versions, some distributions or wrapper scripts use it to force interactive password entry.
2. Check for auth-user-pass. This directive tells OpenVPN to prompt for username and password credentials from a server-side authentication script, which is often confused with key passphrases.
3. Ensure there are no stray password directives that expect interactive input.

If you find auth-user-pass and you are trying to connect to a server that does not require username/password authentication, remove this line from your configuration. However, if your server uses certificate-based auth only, this line should not be present unless you are using a specific authentication gateway.

Decrypt the Private Key

If the key is genuinely encrypted but you want to use it without entering a passphrase every time, you must decrypt it. This creates a new, unencrypted version of the key file. Be aware that storing unencrypted private keys on disk carries security risks; ensure the file permissions are set correctly (e.g., chmod 600). Use OpenSSL to remove the encryption layer.

openssl rsa -in encrypted_key.key -out unencrypted_key.key

This command will prompt you for the current passphrase of the encrypted key. Once entered, it writes the decrypted key to unencrypted_key.key. Update your OpenVPN configuration to point to this new unencrypted file. Replace the path in the key directive with the path to the new file.

Regenerate Keys Properly

If decryption fails or you suspect corruption, regenerating the keys is the safest route. When using EasyRSA, ensure you run the build commands without prompting for a passphrase if you intend to use them in automated or non-interactive environments.

./easyrsa build-client-full client-name nopass

The nopass flag explicitly tells EasyRSA not to encrypt the resulting private key. If you omit this flag, EasyRSA will ask for a passphrase, leading back to the original issue. After generating the new key, distribute it to the client machine and update the configuration file accordingly.

Frequently Asked Questions

Why does my server ask for a passphrase but my client doesn't?

Server configurations typically use static keys or internal certificate stores that do not require interactive passphrase entry during daemon startup. Client configurations often rely on user-held key files which may be encrypted, triggering the prompt. Always check the client-side .conf file for key paths and encryption status.

Can I automate the passphrase entry for OpenVPN?

You can use a script or a helper program to provide the passphrase automatically, but this reduces security. Tools like expect scripts or specific OpenVPN plugins can feed the password to stdin. However, decrypting the key file entirely is the more standard approach for headless or automated connections.

Is it safe to leave my OpenVPN key unencrypted?

An unencrypted private key stored on a compromised machine allows anyone with access to impersonate the client. It is safer to keep the key encrypted and use a secure method to enter the passphrase, or restrict file permissions strictly to root/administrator accounts if automation is required.

What if I forgot the passphrase for my encrypted key?

If you forget the passphrase, the key cannot be recovered mathematically. You must regenerate the key pair and reissue the certificate from the CA. This involves revoking the old certificate and creating a new one, which will require updating all connected clients.

Does changing the port affect passphrase prompts?

No, network ports such as UDP 1194 or TCP 443 have no relation to key encryption or passphrase handling. The prompt is purely determined by the cryptographic properties of the key file and the directives in the configuration file.