Prevent prompting for PEM passphrase - c++

Question

I am building a Qt-based application that will communicate through https with a webserver. The setup should allow client-authentication with a local certificate and private key. The application must run without any user interaction.
Now I have a problem when the private key file is protected by a passphrase:
OpenSSL will prompt for a password, blocking the whole application!
The openSSL API allows to pass a callback for getting the passphrase, but this is not accessible though the Qt Wrapper. Is there another way to prevent openSSL from prompting for a password? Or can this somehow be interrupted?

Answer 1

On looking at the online documentation, I don't see any callback options when decrypting the private key.
The simplest way is to make the private key password-free. Here's how you could do it (assuming you have password-protected RSA keys):
openssl rsa -in privateKey.pem -out newPrivateKey.pem
Here privateKey.pem is password protected but newPrivateKey.pem is not. Note that while this means the private key is unprotected, this is a common technique to do uninterrupted SSL communication (even used in stunnel for instance). The assumption is that the private key is stored in a directory which has restricted permissions and is protected by the operating system access policy.
The harder way is to write your application by directly linking with OpenSSL instead of going through the wrapper. That way, you have a fine-grained control on the password callbacks.

Answer 2

You can specify the password when you construct the QSslKey. The constructor takes a passphrase which will be used to decrypt the key, see the docs at the link below:
http://qt-project.org/doc/qt-4.8/qsslkey.html#QSslKey-2

Answer 3

I came up with a solution:
OpenSSL will only prompt for a password, when none is specified in the decode function. As Richard Moore pointed out in his answer, QSslKey has a constructor where you can pass the passphrase.
As long as an non-empty string is passed here, OpenSSL won't prompt for a password. Plus: If the key is not protected, the password is ignored. Therefore, I simply make sure that a non-empty string is passed, so this is my solution:
// Never use empty PWD, as this blocks. (Use null-string)
// PLUS: setting a password for a non-protected key still correctly loads the key!
QByteArray thePwd = pwd.isEmpty() ? QByteArray("\0", 1) : pwd.toUtf8();
// Try all encodings
QList<QSslKey> keys = QList<QSslKey>()
<< QSslKey( theKey, QSsl::Rsa, QSsl::Pem, QSsl::PrivateKey, thePwd )
<< QSslKey( theKey, QSsl::Rsa, QSsl::Der, QSsl::PrivateKey, thePwd )
<< QSslKey( theKey, QSsl::Dsa, QSsl::Pem, QSsl::PrivateKey, thePwd )
<< QSslKey( theKey, QSsl::Dsa, QSsl::Der, QSsl::PrivateKey, thePwd );
// Find a valid encoding
foreach ( QSslKey k, keys ) {
if ( !k.isNull() ) {
ret = k;
break;
}
}