Say I have previously created a private/public key combination, and decided at the time to not protect the private key with a password. If I later decide to "beef up" security and use a password-protected private key instead, would I need to generate a new private/public key pair, or can I simply add a password to my existing private key?

Is the opposite possible as well, can I "remove" a password from an existing private key?

A word of caution: as stated in laverya's answer openssl encrypts the key in a way that (depending on your threat model) is probably not good enough any more.



Of course you can add/remove a passphrase at a later time.


add one (assuming it was an rsa key, else use dsa)

openssl rsa -aes256 -in your.key -out your.encrypted.key
mv your.encrypted.key your.key
chmod 600 your.key


the -aes256 tells openssl to encrypt the key with AES256.

As ArianFaurtosh has correctly pointed out: For the encryption algorithm you can use aes128, aes192, aes256, camellia128, camellia192, camellia256, des (which you definitely should avoid), des3 or idea
remove it 

openssl rsa -in your.key -out your.open.key


you will be asked for your passphrase one last time
by omitting the -aes256 you tell openssl to not encrypt the output.  

mv your.open.key your.key
chmod 600 your.key


