diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 65a38ef..9987a99 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -670,7 +670,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
 		    if [ "ed" = "$EASYRSA_ALGO" ]; then
                 crypto_opts="$crypto_opts -pass file:$out_key_pass_tmp"
             else
-                crypto_opts="$crypto_opts -passin file:$out_key_pass_tmp"
+                crypto_opts="$crypto_opts -passout file:$out_key_pass_tmp"
             fi
         fi
 	fi