How to provide a CA private key password to create a client certificate using OpenSSL

I am creating a command line script to generate a client certificate using the "mini CA" function of OpenSSL.

I have a CA certificate and a CA private key encrypted with a password . With these things, I am trying to create a client certificate and stumbled upon the command line syntax. How do I provide a password for the CA private key?

So far I have had ...

openssl x509
  -req
  -in client.csr
  -signkey client.key
  -passin pass:clientPK
  -CA client-ca.crt
  -CAkey client-ca.key 
  -CAkeypassin pass:client-caPK <-- does not work
  -CAcreateserial
  -out client.crt
  -days 365

      

        
        
        
      

    

See highlighted option. I am expecting something like this, but I cannot find it anywhere in the docs.

Corrected

For records only. The parameter is -signkey

used for self-signed certificates. CAs do not have access to the client's private key and therefore will not use this. Instead, the parameter -passin

refers to the CA's private key.

openssl x509
  -req
  -in client.csr
  -CA client-ca.crt
  -CAkey client-ca.key 
  -passin pass:CAPKPassword
  -CAcreateserial
  -out client.crt
  -days 365