pkeyutl requires a certain order of the key options to work: -pkeyopt must follow the -inkey option -passin must precede the -inkey option This is not documented and confusing. It would be better if the order was ignored. OpenSSL 1.0.2a