SSLPassPhraseDialog

SSLPassPhraseDialog builtin

If you have password protected your server's private key, you will be asked to provide the appropriate pass phrase at startup time. You can control this behavior with SSLPassPhraseDialog. Its default value, builtin, means that Apache will prompt you directly every time the server is started. You can choose not to protect the key. This is convenient because you will not need to manually enter the pass phrase during reboots, but if the server is compromised, the key will be as well. You can also configure SSLPassPhraseDialog to call an external program, which will provide the pass phrase on its standard input when called from Apache.

SSLPassPhraseDialog exec:/usr/local/apache/bin/sslpp

If you write the script correctly, this can offer a bit more security than leaving the key unprotected (but not much either).