What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc.
If I create private keys without password they will be 100% compromised if one has access to them. On the other hand if I use a password they won't be compromised if one has the key without the password, but at the end of the day I will need to write the password on the apache config so if one has access to the webserver can both get the key and read the conf and steal the password (so I kind of don't see the point).
If the consensus is to use passwords, do you use the same password for all keys (imagine you have hundreds of webservices), or do you use a new password for each key?