Knowledge Base

How do I add a website with a private key and a password?

Updated on July 18, 2026

Overview

By the end of this article, you will be able to add a website that uses an encrypted, password-protected private key to CodeGuard. CodeGuard applies its own encryption to the key after a website is added, which is why it accepts only unencrypted private keys. The steps below show you how to identify your key’s algorithm — most commonly Rivest–Shamir–Adleman (RSA) or Digital Signature Algorithm (DSA) — decrypt the key with OpenSSL, and then add your website using the decrypted key.

What is an encrypted private key?

An encrypted private key is a private key that is protected by a password, also called a passphrase. When a key is encrypted, you must enter its password to unlock it — for example, when you connect to your website using Secure File Transfer Protocol (SFTP). CodeGuard does not support adding a website with both a private key and a password, because CodeGuard applies its own encryption to the key after the website is added. To add a website that uses an encrypted key, you first decrypt the key, and then add it.

Before you begin

Make sure you have the following:

The encrypted private key file for your website.

The password (passphrase) that unlocks the encrypted key.

OpenSSL available on your computer. It is pre-installed on many macOS and Linux systems, and can be downloaded for Windows from the OpenSSL website.

Access to your CodeGuard account, where you will add the website.

Steps to decrypt your private key and add your website

Step 1 — Identify your private key’s algorithm

Determine which algorithm was used to generate your key, because you will need the algorithm name in the decryption command. Open your private key file in a text editor and look at the first or last lines. These lines name the algorithm. For example, a first line of -----BEGIN RSA PRIVATE KEY----- indicates a Rivest–Shamir–Adleman (RSA) key. Two of the most common algorithms are RSA and Digital Signature Algorithm (DSA).

Step 2 — Decrypt the key using OpenSSL

Create an unencrypted copy of your key with OpenSSL. Run the following OpenSSL command, which reads your encrypted key and writes a new decrypted key:

openssl rsa -in encrypted_key_name -out decrypted_key_name

Replace each placeholder with your own values:

rsa — the algorithm name of your key (for example, rsa for an RSA key or dsa for a DSA key).

encrypted_key_name — the path to your existing encrypted private key.

decrypted_key_name — the path and file name where the new decrypted key will be saved.

When prompted, enter the key’s password so that OpenSSL can decrypt it.

Step 3 — Add your website to CodeGuard using the decrypted key

Add your website in CodeGuard using the decrypted, unencrypted private key that you created in Step 2. Because this key no longer has a password, CodeGuard can accept it and then apply its own encryption. For the complete steps to add a website with key-based authentication, see the CodeGuard blog post on adding a website using a key.

How to verify success

You have completed the process when CodeGuard accepts the decrypted private key and your website is added without a request for a key password. If CodeGuard still reports that the key is invalid or encrypted, repeat Step 2 and confirm that the decrypted key file was created correctly.

Troubleshooting

Issue: CodeGuard reports that the private key is encrypted or password-protected.

Cause: The key that was provided still contains its password protection.

Solution: Decrypt the key using OpenSSL (see Step 2), then add the website using the newly created decrypted key.

Issue: OpenSSL cannot read the key or reports that it is unable to load the private key.

Cause: The algorithm name in the command does not match the key, or the file path is incorrect.

Solution: Confirm your key’s algorithm (see Step 1), use the matching algorithm name in the command (for example, rsa or dsa), and check that the file paths are correct.

Frequently asked questions

Why does CodeGuard reject a private key that has a password?

CodeGuard accepts only unencrypted private keys because it applies its own encryption to the key after the website is added. A key that still has a password cannot be added directly.

How do I know whether my key is RSA or DSA?

Open the private key file and read the first or last lines. They name the algorithm — for example, -----BEGIN RSA PRIVATE KEY----- for a Rivest–Shamir–Adleman (RSA) key or -----BEGIN DSA PRIVATE KEY----- for a Digital Signature Algorithm (DSA) key.