I have a small PKI for our web server that will require client certificates.
When generating the private key for CSR (edit: CSR for a client certificate ), I can do it with or without a pass phrase.
What is the importance of using a pass phrase (or not)?.
EDIT 2: For my setup, I will be giving users a PFX/P12 file, which will have an export/import passphrase, since the only passphrase I used when importing a client certificate was the "export" passphrase, I guess the private key is included in the PFX/P12?
if so, there's not much difference for me to whether I use a passphrase for the key or not, right?
So if all above is right, , why would I want to protect the private key?