CURLOPT_KEYPASSWD(3)

💖 CURLOPT_KEYPASSWD — passphrase to private key 💖

okay bestie, this is a page from the libcurl manual (the Library Functions Manual, no less 👑) and it's about handing curl the little secret password for your private key. let's get into it ✨

---

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_KEYPASSWD, char *pwd);

that's the whole vibe check right there 🫶

---

🌸 DESCRIPTION 🌸

so you pass a pointer to a null-terminated string as the parameter, right? and that string is literally just the password required to use the CURLOPT_SSLKEY(3) or CURLOPT_SSH_PRIVATE_KEYFILE(3) private key 🔑

big mood clarification incoming: you never need a passphrase to load a certificate, but you do need one to load your private key. that's just how it is, no cap 💅

the good news? the application does not have to keep the string around after setting this option. so like, you can let it go, it's fine, it's handled ✨

also!! if you use this option multiple times, the last set string overrides all the previous ones — last one wins, main character energy 👑 and if you set it to NULL you can disable its use again. easy.

---

🎀 DEFAULT 🎀

NULL

like, nothing, nada, zero passphrase by default 🙈

---

🦋 PROTOCOLS 🦋

this functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. literally the whole secure squad 💖

and ngl, this option works only with the following TLS backends:

• OpenSSL
• Schannel
• mbedTLS
• wolfSSL

those four, that's the list, periodt 🌟

---

🔥 EXAMPLE 🔥

here's the little demo, keep it exact bestie:

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");
    curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
    curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "superman");
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}

look at that, cert + key + passphrase, all set up, ate and left no crumbs 🍓

---

💜 HISTORY 💜

okay so this option has had a few names, glow-up era:

• it was known as CURLOPT_SSLKEYPASSWD up to 7.16.4
• and as CURLOPT_SSLCERTPASSWD up to 7.9.2

iconic rebranding honestly 🌈

---

⭐ AVAILABILITY ⭐

Added in curl 7.17.0 ✨ (yes, it's been around, it's a veteran 💅)

---

🧚 RETURN VALUE 🧚

curl_easy_setopt(3) returns a CURLcode indicating success or error.

• CURLE_OK (0) means everything was OK, slay 🎉
• non-zero means an error occurred — see libcurl-errors(3) for the deets 👀

---

🌈 SEE ALSO 🌈

• CURLOPT_SSH_PRIVATE_KEYFILE(3)
• CURLOPT_SSLKEY(3)

go read those too, they're besties with this page 🫶

---

lowkey reminder: passphrase = for the private key, not the certificate. don't mix them up bestie 😭

---

and that's the page!! brought to you by libcurl, dated 2026-10-12, and originally filed under CURLOPT_KEYPASSWD(3) — mwah, go secure those keys 💖💅✨