Given that you use the
openssl rsa command, I will assume that you refer to RSA private key files in the PEM format, encrypted using AES256. These look like:
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
Unfortunately for you, all the base64-encoded data here is encrypted (emphasis mine):
The line beginning with Proc-Type contains the version and the
protection on the encapsulated data. The line beginning DEK-Info
contains two comma separated values: the encryption algorithm name as
used by EVP_get_cipherbyname() and an initialization vector used by
the cipher encoded as a set of hexadecimal digits. After those two
lines is the base64-encoded encrypted data.
So it is impossible to obtain the original private RSA key without decrypting it.
Your configuration script must find other ways to detect that a RSA private key file has been updated (for example, by comparing timestamps, reading some markers, etc, etc.).
Since you mentioned SSL, note that certificates are bound to a RSA private key. In that case you can extract the public key from the RSA private key and certificate using:
openssl rsa -in server.key -noout -modulus
openssl x509 -in server.crt -noout -modulus