Relating to TLS and SSH. If my private key is password / passphrase protected, how is this then used automatically during TLS or SSH communication without asking me for the password?
For SSL/TLS, you usually do not have or use a private key, unless you are the server. If you are the server, or are using client certificates (TLS mutual authentication), then the private key will need to be unlocked (if password-protected) before use. The details are implementation-specific.
- A web browser like Firefox might ask you for a key's password once and then cache that until the browser is closed.
- Browsers or servers (like IE/Edge/Chrome or IIS) that use Windows' key store will either get a password prompt when the key is used, or will have only needed the password when the key was added to the key store and will then have encrypted it using a key protected by your Windows login credentials such that you don't need to re-enter the password but nobody who doesn't know your Windows password can use the key.
- Macs can store keys in the Keychain, which works similarly to Windows' key store and is used by Safari and Chrome.
- Software that does not use platform-provided key management or prompt the user for a password will need to have the password supplied on the command line when the program starts, stored somewhere (preferably in an environment variable or a file, but some people insist on hard-coding it into the source). This is very common for server applications that need to access e.g. a Java key store and its private keys, and yes, it's a security risk if an attacker gains the ability to read local files.
For SSH, the most common approach is the
ssh-agent program (included with openssh, or you can use an alternative one).
ssh-agent needs your key's password when it is launched, but then retains the unlocked key until the program closes.
ssh-agent doesn't actually reveal the key to anybody; it instead acts as a service that will sign data with that key. The program's IPC endpoint is only reachable by programs running as the same user (or with super-user privileges), so while untrustworthy software running in your account could effectively use the key to SSH into any machine, once you've reached the point of malicious software in your user session you are already in big trouble.