What is the purpose of the -nodes argument in openssl?

Question

What is the purpose of the -nodes argument in openssl?

Answer 1

The -nodes option -nodes not the English word "nodes", but rather "no DES". If this argument is specified, this means that OpenSSL will not encrypt the private key in the PKCS # 12 file.

To encrypt the private key, you can omit -nodes and your key will be encrypted using 3DES-CBC. To encrypt the key, OpenSSL requests a password and uses this password to generate the encryption key using the EVP_BytesToKey key derivation function .

Depending on your version of OpenSSL and the compiled options, you can provide these options instead of -nodes :

 -des encrypt private keys with DES -des3 encrypt private keys with triple DES (default) -idea encrypt private keys with idea -seed encrypt private keys with seed -aes128, -aes192, -aes256 encrypt PEM output with cbc aes -camellia128, -camellia192, -camellia256 encrypt PEM output with cbc camellia 

Ultimately, at the library level, OpenSSL calls the PEM_write_bio_PrivateKey function with the selected encryption algorithm (or absence).

Answer 2

edit: nginx v1.7.3 added the ssl_password_file directive, which reads code phrases from a given file that has tried each code phrase in the context of encrypted-private.key

indiv is correct that the argument -nodes means that OpenSSL will create UNencrypted private.key; otherwise, you will be prompted for a passphrase to create encrypted-private.key. see req , pkcs12 , CA.pl

however, I believe that the goal (for programmers) is to:

• HTTP servers (e.g. Apache , Nginx ) cannot read encrypted-private.key without passphrase ->
  • Parameter A - every time the HTTP server starts, you must provide a passphrase for encrypted-private.key
  • Option B - specify ssl_password_file file.keys; in the context of http { } or server { } . [ ref ]
  • Option C - use -nodes to create private.key without encryption.

useful: block private.key

• {add HTTP server to ssl-cert group}
• sudo chown root:ssl-cert private.key - ch ange private.key private user for root user, ssl-cert group
• sudo chmod 640 private.key - change access rights of private.key to the owner of R / W, group R
• now the HTTP server should be able to run and read UNencrypted private.key

Option A

higher security, but when you restart the server, you must manually enter the passphrase for encrypted-private.key

Option B

medium security and probably a good balance between A / C

Option C

weaker security, but NOT requested for the UNencrypted private.key passphrase