How to fix Error: Missing passphrase for encrypted private key (passphrase required) in Node.js

What this error means

This error indicates that your Node.js application is trying to establish an HTTPS server (or make HTTPS requests) using a private key file that has been encrypted with a passphrase for security. However, your code did not provide the passphrase needed to decrypt this key. Private key files can be password-protected to prevent unauthorized use if the file is compromised. When Node.js reads such a file without the passphrase, it cannot decrypt the key material and therefore cannot proceed with the TLS handshake. This is a security feature - it prevents anyone who gains access to your key file from immediately using it without knowing the passphrase. However, it requires your application to provide the passphrase at runtime.

Typical symptoms

• HTTPS server fails to start with "Missing passphrase" error
• Error occurs during server initialization before any connections are accepted
• Error appears when reading a .key or .pem file that is encrypted
• Application works with unencrypted key files but fails with encrypted ones
• Error message includes "passphrase required"
• Client applications receive connection refused or unable to establish secure connection errors
• Logs show the error during startup, preventing the server from listening

Common causes

1. Private key file is encrypted with a passphrase but no passphrase is provided to Node.js
2. Using passphrase callback function incorrectly or not at all
3. Passphrase was entered during key generation but not stored or configured in the application
4. Encrypting the key with openssl without considering how Node.js will need the passphrase
5. Key is encrypted but the Node.js code assumes it is unencrypted
6. Environment variable or configuration containing the passphrase is not set
7. Incorrect passphrase provided to Node.js even though one was attempted

How to fix "Error: Missing passphrase for encrypted private key (passphrase required)"

# Unencrypted key files start with:
# -----BEGIN RSA PRIVATE KEY-----  or  -----BEGIN PRIVATE KEY-----

# Encrypted key files show:
# -----BEGIN ENCRYPTED PRIVATE KEY-----  or contain "Proc-Type: 4,ENCRYPTED"

head -1 your-key.pem

const https = require('https');
const fs = require('fs');

const options = {
  key: fs.readFileSync('encrypted-key.pem'),
  cert: fs.readFileSync('certificate.pem'),
  passphrase: 'your-passphrase' // Can be from env var, config file, or secure storage
};

https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('Hello World');
}).listen(443);

const options = {
  key: fs.readFileSync('encrypted-key.pem'),
  cert: fs.readFileSync('certificate.pem'),
  passphrase: process.env.KEY_PASSPHRASE
};

const https = require('https');
const fs = require('fs');

const options = {
  key: fs.readFileSync('encrypted-key.pem'),
  cert: fs.readFileSync('certificate.pem'),
  passphrase: () => {
    // Return passphrase from environment, config, or secure storage
    const passphrase = process.env.KEY_PASSPHRASE;
    if (!passphrase) {
      throw new Error('KEY_PASSPHRASE environment variable is not set');
    }
    return passphrase;
  }
};

https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('Hello World');
}).listen(443);

# This will create an unencrypted key file
# WARNING: Only do this if the file is not exposed to untrusted users

openssl rsa -in encrypted-key.pem -out unencrypted-key.pem

# You will be prompted for the original passphrase
# After completion, use unencrypted-key.pem in your Node.js code

const options = {
  key: fs.readFileSync('unencrypted-key.pem'),
  cert: fs.readFileSync('certificate.pem')
};

# Set the environment variable
export KEY_PASSPHRASE="your-actual-passphrase"

# Then start your application
node app.js

# Or in a .env file (load with dotenv package)
KEY_PASSPHRASE=your-actual-passphrase

# Or in package.json scripts
{
  "scripts": {
    "start": "KEY_PASSPHRASE=your-passphrase node app.js"
  }
}

echo $KEY_PASSPHRASE

# Generate private key with passphrase
openssl genrsa -aes256 -out new-encrypted-key.pem 2048

# When prompted, enter your new passphrase
# This will be used in your Node.js code

# Generate certificate signing request
openssl req -new -key new-encrypted-key.pem -out new-request.csr

# For self-signed certificate
openssl x509 -req -days 365 -in new-request.csr \
  -signkey new-encrypted-key.pem -out new-certificate.pem

Advanced notes

const express = require('express');
const https = require('https');
const fs = require('fs');

const app = express();

const httpsOptions = {
  key: fs.readFileSync('encrypted-key.pem'),
  cert: fs.readFileSync('certificate.pem'),
  passphrase: process.env.KEY_PASSPHRASE
};

https.createServer(httpsOptions, app).listen(443, () => {
  console.log('HTTPS server running on port 443');
});

# Test HTTPS connection (ignore certificate warnings for self-signed)
curl -k https://localhost:443/

# See detailed connection info
curl -kv https://localhost:443/

Frequently asked questions

What does "Error: Missing passphrase for encrypted private key (passphrase requir" mean?

js application is trying to establish an HTTPS server (or make HTTPS requests) using a private key file that has been encrypted with a passphrase for security. However, your code did not provide the passphrase needed to decrypt this key. Private key files can be password-protected to prevent unauthorized use if the file is compromised.

How do I fix "Error: Missing passphrase for encrypted private key (passphrase requir"?

This error occurs when Node.js attempts to start an HTTPS server using an encrypted private key file without providing the passphrase needed to decrypt it. The server startup fails because the key cannot be decrypted and used for SSL/TLS operations.

What causes "Error: Missing passphrase for encrypted private key (passphrase requir"?

Private key file is encrypted with a passphrase but no passphrase is provided to Node.js Using passphrase callback function incorrectly or not at all Passphrase was entered during key generation but not stored or configured in the application

Is the "Error: Missing passphrase for encrypted private key (passphrase requir" error serious?

It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Related errors

• Error: Server already listening on port 3000 (server.listen called twice)

  Server already listening error when calling listen() twice

  HIGH

• Error: HTTP/2 stream closed (cannot send on closed stream)

  HTTP/2 stream closed error

  MEDIUM

• Error: Socket is destroyed

  Socket is destroyed (cannot write to destroyed socket)

  MEDIUM

• Error: HTTP/2 invalid settings frame (malformed settings)

  HTTP/2 invalid settings frame (malformed settings) in Node.js

  MEDIUM

• Error: zlib error Z_DATA_ERROR (corrupted compressed data)

  Z_DATA_ERROR: Corrupted compressed data

  MEDIUM

• Error: Could not find package.json in current directory (npm module resolution)

  How to fix "Could not find package.json in current directory" in Node.js

  MEDIUM

Official resources & further reading

• 📚Node.js Official Documentation
• 📖
  Node.js HTTPS Module Documentation(Official Docs)
• 📖
  Node.js TLS Module - Passphrase Option(Official Docs)
• 💬
  Stack Overflow - Node.js Passphrase Questions(Stack Overflow)