How to change private ssh key password

The goal of this article is to describe the process behind changing the passphrase used to generate ssh key pair (private and public) due to security policies or other scenarios where passphrase tends to be a liability in strictly security sense of the word.

When the ssh key is generated and passphrase selected, as a part of ssh key generating process, the private key is being encrypted (at the time of writing this post-default encryption algorithm is AES128) and the header is being added to the top of the file content. Generating this key would look like:

~ orangecloud$ ssh-keygen -t rsa -b 4096 -C office@orangecloud.systems
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/ivan/.ssh/id_rsa): oc
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in oc.
Your public key has been saved in oc.pub.
The key fingerprint is:
SHA256:o9wX6vBL8cwHHybbNZk1MuBcBa1i9IKd+s6fP3CLVsU office@orangecloud.systems
The key's randomart image is:
+---[RSA 4096]----+
|           . o+. |
|          o.o  . |
|          +ooo.o.|
|         . * oo+E|
|        S * = = .|
|     . o O O + + |
|      + + B + = .|
|       = ..o o.o |
|        +..ooo...|
+----[SHA256]-----+

Password used in this process was thisistestpassword. Let us look into the content of newly generated private key:

~ orangecloud$ cat oc
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,0C889803ACE1A2875533D8056A40AD19n2qZqtAxkFHkcyfHNSSCtoGYOf47EuDGFIY987djteu65KEjwtkstrtPZXUZrcYfKKb49GygBSkaDf5JfGpumRAnOb22DETTahz0VXrmduk0SfMiZ3/loneBQ3oXD9yMfTFgIzT6yT280MyrWA0Z4qP9q59/pO4kFVzPeAQgJ46FBSuERH/cGBoEekH5UcSIJyzJ2t3+1QWN3Ly3/8ocnXctPLZg87mxQAoEK0GqwzFt+NGQJsHOxjTJgV464Y6KM3DlRFOtoNAPN+j9J6OZqq7QZoOflVS7EPP3C38Pgl4/uh+hd+5zRbEvNS5+nDaNwAoQ6uZCVrDTNPYMwALhtmeOL/qkha/4NZ6GXxlVRpu0ELOBc6x9bp8msndEg9oc
HqF1TEigq0vlvwq5i6n84v3d49Hziqt0LhTaxB6SJKln+3TyqpfytR44hNKBwQ0s/9aM2PiJsXEBN6BIqcMwx+kmuHFuKbzNZMu8lyAubpjL16r2FGNGzmp4UVupbk/TeZR8Q6rE0cuJMyFHqad0Jn66CcWZpb51IOINMqIbhkFCsHqhNquvN0XSLmCFh7pQKG1HkEfhNmvKMIngO6f0HjbgwknRm43wzkpWdeSVvN+0eUMkqnDs7sEbqxndvv5cojtPWZRnFBeXHby/FDHRxDAqXRcF2kPpdd83yJCs+7oy0rikPekUClkwABElEpH/OOhWBZ44DJBLHvOiQqWZLVphVK/IvZnFcrz+mp+vcnMOESorzfmTrb4X2WG2PUbIdUa8PbvCiiBg3PhG5Q1OTPBCQPEv1Cl5hFFsXc3HCa/qLED+XMQMdI5ydqZj7R/gxJk5zT3iyJp+2DUQql99q6aWS1a1oJB3aQ1bI3WWVfwPi3ueCGkv/yxgVtdV4ZhOJHOnqVwBC4bVxXC+RUY5CMdBL5Lw6j8ds9e2luHppLNbBBlh11NNlCTg0XtX+i3875jFxbwom8GVJYJEVs7HPwxjNTX/1yjMLFDNEUMe3SrkiuDyH+jbXTFFGCSUliTAZiwhIdm9zYp14CFdSADmA5L6YNEKnKxecTcMdM4z12N6VweRoJg5O9JRNysrZ6g2l16AiFZ3sAM7F1omOdNzYQUVhEDIJURcSUdCDOwgHr8NNj4oshIXndf/cqCHSC7zfIprDMh5zQMg/+6YNIW/JD5fRXrANM/bRQ5gx3r5ujDnO+0fvzkBNMdd8ZTkxlbBhvimXF3WTgBJ9BG6XuOMz/WEyfa/ESywSYksS3DOHO9QvZ23BrOJK+jGqkHv632Bd/14Ubul80pPVx0zgXgCgQkacbF4tgH6Fac5nKkSZnsNsWBB90A8cI4WLnSs4872
lbK90C5+uWSCcxO8DKt1hEkmaqAq9z7WfAbPDpcc+Ya4Aoy7gIJ8ntjpfsljrXjfX71t0Rwvn1FM3c5eYOxXrcLyfpbRsPQHAETzvUG1w1CFbe79+pCxeqOWATMk0mSyLyuR6Kd3jnee8C4gd+m6UciJldfDqZoJ/eC6IV/UlWEMgN+ct7vogjPkSu2T9NkOWvVL5sYyBaQKdsLD72XI3wHY6yly9Ir/Nhww981TVk4FIh/8iTiP7SyRQBZrf5MY6kgD2Vy1/v6yCs4a+Cen4ogv8W7BDSHoZF1bvePz+eloZs/ajxD1xijH/Al5xvg1z9JlM0n9WyOjAlbnj5luouTXXlAc/ocd74ZtqNkgFEOARXFDXjg4KQ/n7rjgZXhNEOd2NG5vb37JVZSMpgZhJDqyfJu8vX2qMJHaT9486xtWu8oEPgD/rh/hZcn6k8oyiVEaKMExrh8jYRLo7gqz7B1zDzIm68+1dwSJom1ZNgzvkW3ZxfEzqTG+tjH76BFdaKlR2GqNq5TUP5gYICU9K2e6vp5SgQi+o6iCk+GH/SsXcSiODClaXR9yVCxuY+nCfqzeqILUaYnH1JCM8RfNZQDrFAuGmZtL6KM+mg77WieX8GWh67p6enAE0GecLsnltomfqj0VqKv1RpknGxgff4UqPgeALQRmjqkrBmw8lC3NiFXjIVOnVJwZy/PnFOl9Q6KGlVxm204kJyK3dpHGD2MASm0kWMdDh5vtrg70WGGr0ebqWqGLGyrK34wPIMzmMEC+EgqsgFwJWHxJ7Cngo7LntUx0Q7+NQdZ7quOYQGPUefyoMnmIJMILJHpua30tPD6RIaedFVh6WQLYS3AlTtMrPrYiWSR5yczhA4T3WkBFtke+jZYjHc21xXPD2TgWm01RvpSiyDY3pEUe/JRU44srx2Sre6eQesP90TTkYCVWDa8s7gmlU8KAEfDYDOnc
N/w8W7kh5AQK+hgaYP6UUr+E4DwGBtaCcZvZhjaiMGLbi7PagyyvW8UqmWsIsAVLKqBn1Xa8MfaBzm/lCX8Ghxlm89aM+f+bUMaJ1Cf3gG2G9/58IMm7xTzEpaCGpjCl7CZvhuABb/pywMmNnhNVsRmhKT+PPP+cj78sPpp5E4bzo1KOcZEJfU18DUXbS8zuSD+njWH85wJZmS11lKzlms1060cRcX1XTbIv5lDGvktxWTeYMcih6Op7jrRf+q5c+fAI830sziGlGlpa0m+U2mjoupMwlGnlpH/teq7vObTQUsSpcJ6DLUHQotmckofzaCKJ2UPhhTcpaenFUm3RuxRXSnb9EO7koHGHjwn7DWQ/4ZeQyelSftQgHTPf1s/KiE3AFpWodrLOQAcnXzqherfqk3nzg23DYsQ240MQAMCuQ8Hn1NuZcVAPsp72dS69jIFaDJLLS0lJwaEKuzJmIF/GMaRDYRpvAGp933C4kCu9nK3gd4AN9ApSp8cARN1nLLE5OaBz7s0CZ1aO416fsOkL5xaB7MNQgeYD4zAn0FxDymyEAwTZhJc4sB3hTuAGLFkitKLsMf1ffhi+VUQRNtSzzHI8SqAfkkZtB47rpvRtAAATqfdbcKV9gBr9UonVdhOI2eYR8KC/aigrn2x3mQELGqKsy1RoWXYmE8geNGNmYcCoxStLfB98p3JoyxUuCRPxsCxB0emeIDAsp49VcvhC1e5JyZq7OmyHvzH9sXSlz56RNdbEcC1z3dHxutRfJrqOpUQ49Gh9ICpiX/gl8eyCCf7ezZbCHOb7vO0/CAH0AdBFEmVFONlN4vm+IC2f
-----END RSA PRIVATE KEY-----

In the header of this file you can find Proc-Type information and DEK-INFO which is needed for this key to be decrypted. It shows encryption algorithm used (in this case AES128), in which chaining mode (in this case it was CBC) and first/initializing vector for chaining mode (0C889803ACE1A2875533D8056A40AD19).

When connecting to desired server via ssh you would simply call ssh user@server -i /path/to/private_key and then put in the passphrase used while generating the key pair (in my case it was "thisistestpassword") and if remote connections are allowed AND key file permissions are properly set (note that for security reasons you would need to set the permissions on key file(s) to 400 or r-- --- ---) you would connect to it.

Pretty simple? Ok, so this is all perfect until the point where you end up not logging onto this server for some time and passphrase used has gone away and got forgotten. Then you could either generate a new key and ask system administrators to replace your key with new one, which can be a long process through approval chain or you could simply change the encryption passphrase. Step by step process would go something like:

openssl rsa -in oc -out oc_new
Enter pass phrase for oc:
writing RSA key

Password for decryption was the old one "thisistestpassword". Decrypted key would look like this:

~ orangecloud$ cat oc_new
-----BEGIN RSA PRIVATE KEY-----
MIIJKQIBAAKCAgEAyhxEPJMmetR+SrdHHR+eXFbeOYk1Po3IZZJGd6g7NVc5fS8x3PEY9Xug1H+bysqtxpwrCkXQWhOMLECuNM2cdZ5I9JWzbq31m/t3wy5O/H1Qk3Bok/BacVugCrE2uccF/bnDJokbpeBQfWej8renwx9DbCaT2eBsgAcW4kzydOLy1/d0LgH/z/MOZ5I1NN9P/IYD8BYci6MgJhGmzuBEV9wjHeHRCW6lKVdjpoKS8uakrJxpgoTEBRPWfYzYDs8Ug+91t6/QQF4BIoBvijUcpaJdQ4KOet1khl/uM/8ljeY5l9obsgcHWeeRnRxPMFv5hvdkxNopmAkpNFGGa0d1yBr2tDOmb8t1UcUjZW/65ON0ASfic3qyvRHTy5mxO/WE/qgK/wkMlWVyXpBtWwnI7JcOLg6R1U1OaQGnZVhSXDrGshFU8XH4DfqiFFKe96f6su2rJo3sHchyvgxuYm6eaQF2qW0aNtKOJ2DhF4L5zFWrF3oPTok7LCQZmy1XdFIVOpOOS1m+B7AbQkgDLnTL4Th2Y5ztUnNDU6JZ7mEIjVJxdP46WtevSCc5SeKA6MgfEx+cfRTTTipFU3/pazf7hbQE7+95SdglyBzFw61Zc/Bu65RjQNRbR3K6qEmUGD5vEyNMuBw9MPnEjIqSNx/0K59DJANXAg7SNgtFk3VL7VkCAwEAAQKCAgAn7jW9EgWENv9Mm7E9G8YZ0D/PdkBCv5hcGO47Lc2k2DrPdMeRM0EPHwHDegK5qhlzJ9+JBAoKAdqr04uXexfyVPds+zacI1pnGuOqeDe6wrdsqcS/lbkItGWGN0Tsp1mTq2PW9Te1KgA9BoDpr0dB0adscqK7ZQ+Kq9vlkfZFCaGY8ZbOkC6OUyMBa21/qK8Q4RleEcBKBkyPuOUP8lcOVLvLZ5X5Gxced9mESD/oJZFbWPuvgbOInUa/
P1hgdKFE/8ZuKBoo3Wmz+1QOJjgmsVFjySOFOsBlnAZf14T/6ABw8/KM1b6qEIpAVBuBHmrKM46BJekZ1JWDdKfuAgxOxpZScxYuOzqf2UnaXPBSS8CCW5LV6KZKy5rhOO6n61i5faw0Yr4lGhjAvtt+255kn5lLHSr0tL71JuS+qqn25b/zVDRj0o5FObrYDbP89lS2+fmqRRiikoqMCA7wNnF6oy1BiRxV0fnHkkpN8D1Au+RUn//CTr4EQ43jPDAsjYZFiVEhpDqH5qVmxkmbEIa9zr22OiyybhktKIGX+6RIWdHYHAC1LYoyUSKduk5XOxcdxbF3Ci7+DS0iwE6AqIfxNnmrHU1lrVGOGKDm6bdSG9SPuOoiC6gn8rOyIh4ep9LcMMsikdmsRHM33sk6NMw+VsdIXUIpfMJdT1Aum4bO0QKCAQEA8ixW9mLSa0DL6oYRB/p6zQAHpeErQLUO79yKZNtCSiOxlwWsG2y4TR3HroUq+lL2ijZW+4P3y8cPOD9AErnHR8wUr+xcfoOGREYwgjxioy3XV9h/ObTpCT9ChFWNTs/E+ZcgfPIgXXyhbS+R9dnbbNFPPxc4cZClom3nj6CUB9kG7vH1xTBg6H9YTvcpqwpx5N3dBv4AGw2Q5eFgXP9stwBXvDx2exOxPqmQpuXjUQy5LjwkV3C4wFIJXgZRgmphsyXu20L6lbq/s0rzceMigqOl++cFmvbsHwvTrTMCh+wI1zuZH8bZVOvyOeacS90D8unmjzmqq2LCA0oqDP8K6wKCAQEA1aZcGrD2yzDnNcQ/J/fjZ01W08GChdR80ynaZhvKfq8azLyGRouzLMbkE+JhbWPERBYG317P1H8CXE9wpvAZQ9PDLiqoRMr5mHaV52XuGjMCre5oZr5Kbr+6v6KsXiwZOPzIUWUVdmu6s1wa0IWL+UeK7rkWrPkn99xxOORV74wY
wxXAUaS97bPZSrwdlC3Qps2m7xXnSVmFph1Hw2rgldzKay3fprkrmj+No3GM1NId5qLDl2JDPZlzJjZHhNafVD/aRK519SqrNL/dOskLiLWce0QZ5M5W13JQQ8xjfqXCLY2dRDAmzmBOq3BZnzZ9a9yePl2Vaa+hPCYouJ+PywKCAQEApmF0Nb7bVjikYLJPTS335JQarQqwTrqWUpEwu+4v8wPm5R1Oi2D8lm7ZW7u+NVF+dKK0zAR04JoYiMpb2QGuOlOp+tvnCDyQqKOYfEHEetvp0T662gjC+kluB8FHXlg8ukXsWit3tQMFXSCLpV9R88cyLORlMRDx21CrAPCQA3xF2TB/bES6r8GeCFKjXBHHAjizvDQSGoQNgwJ+1CXgqTIhFQBtXk2/Po/9A815iZu2Nl+3kCOvquIx8Vlh8rnn+c8b9aRkyS4Our3J1/r3IM4SIaktHrR6sTHM8nfTS1MNF+KoZz6U3lVkjAc2ZqCoL+InN0ulSC6HoP75OQiYlQKCAQEAud8Zkj8S9oN9I1GwgF0xAdZPC7r2iufqEOwAjYTwDnbYofYB+63eG76M/p+ck0aQoYtoPzyFIyG8NAMIxrNrx46b57ZE3lSYAQRqNf5/v1tRoXAgdAJpTyCOn9oui19iMin5PJbsrTHcI96llXQZ6q1LOZTdHW9GTmUCO7Sq7tS7Vj2+K0lf00T8bgBq21dghz2zVZ2Aslen5nTi0ihRaw/DKqumP64pOPDBkMhg9WY3jUddUn6ycQznGP9wCSmPRASpJ8d/5+NPP30MQvBVkIIvuS3uORkqhBV3rwRKKwyaencRsxkRKcqvpob/8Xu+cfBl22wfaOrbIzEvjC+FMQKCAQA1x75ZiIhqfXo9tUutD2RkvtXa1WuSdKi/fhEyJfHBGVTJZiF2wHcC7QQZgJ9QVoFItXVrVFwO9IK0uh/SQDTXqlEp
8zKqleZh85odG7v9Efbauf+DwF1+CnRoRwoxrDExyCe74h9Q3nplmxKsp+PDwnUtbqbqpmtS2PGU9PsmsnZGabtCnw/YSugNqIZ6gSnjMIqCmHRqhnH72odbJPJrFsjtUEXdvoGRX6vWPuixyGSZHtEtru92L8mRRs8hq2+eA6IpMpb5EtpohHetMNRFDWqHIKqmK3DPF2R1XhDQBbQf12me+M/qo6fqGbwne8D7YdAWEQjpEJRRlRjk5eoZ
-----END RSA PRIVATE KEY-----

Now to encrypt it with new password "thisisnewpassphrase" we would do something like:

~ orangecloud$ openssl rsa -in oc_new -out oc_newer -aes128
writing RSA key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

And newly encrypted private key now looks like:

~ orangecloud$ cat oc_newer
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,0C75618CB547A2F89F02DE8164373521

4UIITHD1wak/Vpcmc21iGJJc7/Ew3bXlijgp54Bw73qIOHQEgIGqFhiafKuf5o0RtGNPEygScv3YfsU1St+s+VZufGriJhIYWaiUPxxRz2Q9zdUYbTb6/Go5rFtVcDYgl9U4TZ0obX8ZXldJhf0llqAzKErdhhpSEJdXUQD+WuAJ2wn9rMbMvOtlyU3ql0BIE+fT7QP+dZGl/c0qVljQHG/wdo1Q5iWZTh6DunfgXXVmiOeE5qm8hC/u4TkPtYJY7Rul7E1wHmaJYj6KzKBSWBPGnItzJvXpz7ZrR8kliCTF4KrbZ1+60hIlSVFGrCnp1ElOXDq7nXJN8VNhc80FokfR8LEnb2Dkj9i7pHnkEx+MwoUCicSb38NGLvA7cjKFFenb5XeUtfe5e2pNEql+9xEkih29sBWutcSlSoDpRqf2zzbILiXSd5dVjUPxzO/NXqbwXYvkC6iJD1oDas05rjS5wawQGP1i7nD5mL9uond8z4gMSpfctRxEQZAIW7FHN1uG2V43Ey1niY4gxuV79vCFBm1o3+LH3yZCY27t3hhfzpzYhy84+vIyWFmC+OPM1BxOMUm5usqtSiS/tg/quJMqGzknjG7hKDsOlvymepV81hiarI5bh61uGjJ9EEDyLhe16sFSJ1b6HUs3Fluzk8AqsLYMWn8nIcgejl1PtK7htoAWanrbYODfpF/zpwrXOws2sBiDG8PttQYWXagX5GC7nKnb2UcNFLArH44c3dAyZwcVeVgEHrLJhDY/aTDTJeGt+YlmtZlY4VbvmuV8FNjRv0mQrqKEDxVHWjT48Vi5eszhGHsQjg+yCmsHcpuiZpKvcXiX7vA663iqrGBS42QhNriSbQguTImjPO/cZzSvrc4daYW5IgzcIjil+ipJ6UYD1kr32HyFE+qpPZOZiwLrpOdDzS18wxmPox+Aew3l1VLnY/IXZpQGZk43Zw2U
pDz3lLreJ4kQEcdJPIEiAbSxNKphsYbIHbhSa/ySwKG42YVMvwfcDX7hPR0hMj4wKFfQcR7xlRUB5CRDOgMpYWcdEQeLFo5X6ozuN0JXoBayaj+tC7CFzoIr+ui8tWyHCSy8mUal7O6vupLry9xbkfcqjJn/urZh/UNT8zBJb5m8M3gNrgKCICtqn6Qllk2rI4WU6YwhITjxbzCMqYmUufh3+7DjbrtvdoKv2A0it5P08leY8BAI4C4eiL9J6vQ5V1TlNeb6JNbT3RshZnLcySaZUcCKwoHTE60BmpQNI//SQUJ7AkNdmuaci8CQCZGQMRUr4fE2ssMl8xFHuIuLmm6ohcsapo4jZjFAUQvmC97X8CkBbZkxm+0Q+1AWCNxNeuKAgBbmyOmqJg/nvCoQOANURBJQVdkmTMHUxTLpi+AKr150bPfOrHK72GC0ZC+fRVmWCejXlm6+PI7wn0B8ITjRDPUcICu97ckXr07l3tXTy7/WWGjWBbt6RXfTo2ZH/kEvoppGN4wQ6GHjzq5R8GcDW/M2vgM8DnpKx3VrFixpWFf4d5/3XfE63tguXUZJ8cjQAt7BK/OHqMV94ULVDfFMmPn4FIx7jXcKJwfU74TgN0OE03qz7KYCbQ97vKyvJRdF3pbqFxlUJRcRHw39aXLTkfGeV/GQooCjKP2M0ygkDRRNQg/kD/hQLjtWYk9KF+feZVt5scY2hTizfstxTsqBZxNq/Po/CZyDZuoPs383/BiMuJ8bD2SQLhc6ofLcRYjkE3tozqnZJBg2QYr+rQyHZ65zqh7gyLcRMyYOOvDqMfJkRCGovL/bIIY15WOGucf1y2YNby4GnSanFjc1SS2mX7X/U/XKdKVRdBDTyLWGbcEL2bqiM86D65ZuuwMbhpNugXnTGaofa3RMttqzrPT4FvrZU64DrZRqm/guFKDAQ6oYRt3pOVdgdm+/mEft
1+0N5tdVlwoq+7Jt7s/0ineW70TWFDYgA19Gt6TdXoZGrIlWX+kKV95R50KRvsRq7D7jqQ44oHmLgqJJLRUYxlWFvMNyucwJqybpRucuzQ8Z/OgcuEglgPD0ElBVQK59zOo3AC1ebEMkxegKWdA0pk74FZGMU+6eulweppj/o44u7qS+Zy6b+fyiz9cbPIr6tdZ6T5KVfAVW7eqx3Pa/PCR6+RFxGdrIYlGY4THm3l9Lny4JDqSCTHMCMhQ5w8ypQEH8Qi3cbge36yZKkgtxSkWBER7HZy/sL2UKqN4EdIJkh4LyJVuVMCcYk+oaeTM77MCKf8isO1Ywd5jTntFj0R1HHFnDG6R118vXd0nmIbztYgPFKpCdl8K6Ogs5FlsCpXZyZXDGU07yKVo/CyesjUwBJ2pAz+Drm3G1asDZmlnslpm9lb0qBiw2DrXHpjlcdJP/kF8y1xYvWP9+W2i0eirHGkCvgZbUpHo0yRExSrdk5i5VoyHmIoUpz2fVmHs52tmDttfq7mDiE9R3eIlQNcTBqTTJ6Nv3VgxFFAhsAmAkBMrdFqdQZk7EMQzytCSgngN0MY2N3KEp8kO3NiARbM0lO9ZTDtO6tlsmdqdryPvajJ/HPW+RfeQVQJzjnJCxuNIX660+48iNmqX/fKba1dgMPd3mmpyin8nuhHifjd3jg2as7qQ7iOnw4pe36Z0zEI2Vb3vRUeAjJXjaJ0W/U2c+SNZi38Ey+dV7VwuPWAd/Hr9IWcC3oQf95qPvwB3MDjkox01++TLDLNkjY2c8firhd+Z2MJGMsSG2ITUol7I0Px5ZJ7xi6XwCMM2Slj/OG+ild2vrw+P7yltqzvLCaeXLSpWpFyAIj/dvC0ExAgsD+FYdEVtBvXoPmGUBQI5yKeb+f7MbOJ8FcV3L3RUNDGpkggVZ9SGEytQKct+oMc8Vm3PiLrIjWPtBBX9DcYQI
mRr6lKyTTxLT0FWRJ+eslwzqykSHt+EwT+3uFkzQkDph1qMzF/rQjVwSzq3Be0dm5AU8NefAfFflaT4SkiZmJUPGag8aRBXdibRHspiftoDR3qBwy4/Fm+H03bpdIL+r1zph5KctVR+CuLef3DqXKcYKHZnG7uXMLEOBHExztWx6dER6bW1gWmtU1Bsir4FMa4G4j4X2ANfhOtlFrJdNf7AKGaSROdBBUXlsF6yJg0LtrKS74PG89J99YSAQXy25
-----END RSA PRIVATE KEY-----

Needless to say "thisisnewpassphrase" would be new passphrase ot be used when connecting to same server from this point on. I have taken the longer way to change the password so I can explain some of the steps but, (don't kill me now lol) we could have done this much faster:

~ orangecloud$ openssl rsa -in oc -out oc_newer2 -aes128
Enter pass phrase for oc:
writing RSA key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

In the above steps, we've been asked to provide original passphrase (thisistestpassword) and then the new one (thisisnewpassphrase) which resulted in creation of new key pair where the private key is encrypted with the new passphrase.