How secure is it to bundle unencrypted private key and a CSR into PKCS12 certificate?

Question

I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, use that to generate a CSR with openssl and then bundle the two into a PKCS12 certificate, also using openssl.

My question is, how secure is this? How well protected is the private key within the PKCS12 and what openssl commands should I use to ensure the best level of security for the key?

Bear in mind that I intend on using my signing-only private subkey for the certificate instead of the master one.

Answer 1

Well, in the final PKCS12 you should encrypt the private key. The pkcs12 utility allows you to specify how you want to encrypt the private key.

-aes128, -aes192, -aes256
use AES to encrypt private keys before outputting.

-camellia128, -camellia192, -camellia256
use Camellia to encrypt private keys before outputting.

I would consider aes256 very secure for a private key.