title: How to specify CA private key password for client certificate creation using OpenSSL
body: <p>I am building a command line script to create a client certificate using OpenSSL "mini CA" feature.</p>
  
  <p>I have a <strong>CA certificate</strong> and <strong>CA private key encrypted with a password</strong>. With those things I am trying to create the client certificate and stumbled upon the command line syntax. <em>How do I specify the password for the CA's private key?</em></p>
  
  <p>So far, I have ...</p>
  
  <pre><code>openssl x509
    -req
    -in client.csr
    -signkey client.key
    -passin pass:clientPK
    -CA client-ca.crt
    -CAkey client-ca.key 
    -CAkeypassin pass:client-caPK &lt;-- does not work
    -CAcreateserial
    -out client.crt
    -days 365
  </code></pre>
  
  <p>See the highlighted parameter. I expect something like this, but I cannot find it anywhere in the docs.</p>
  
  <h2>Corrected</h2>
  
  <p>Just for the records. The <code>-signkey</code> parameter is used for self signed certificates. CA's don't have access to the client's private key and so will not use this. Instead the <code>-passin</code> parameter refers to the CA's private key.</p>
  
  <pre><code>openssl x509
    -req
    -in client.csr
    -CA client-ca.crt
    -CAkey client-ca.key 
    -passin pass:CAPKPassword
    -CAcreateserial
    -out client.crt
    -days 365
  </code></pre>