Q:

Best approach for storing private key

I'm working on a web service application which uses a self signed certificate. I apologize up front if this turns to be a dumb question. When using openssl for generating private key, it reveals (as per my understanding) the encryption algorithm and initial vector. A bit of googling showed it follows PKCS5. These information of algorithm and key was not present in another private key which followed PKCS8. 

Does this mean that PKCS8 has better security ? At present which is most popular and secure, while there is a requirement to store private key in filesystem?
Private key is encrypted with a passphrase and I use the hardcoded passphrase in the code to decrypt it. Is this the right way of using it?

A:

PKCS#5 (RFC2898) is a standard for key derivation, not for key storage. Openssl can store an RSA private key either in its own format (default) or in PKCS#8 format. You can convert a key using the openssl pkcs8 command. Securitywise, there is no difference between the two.
You should rather store the password in a configuration file or make the user type it when starting the server software. Otherwise, you would have to recompile and reinstall your whole software, everytime you change the key's password or the key itself. Also, the password can be more easily protected in a single file on the server than in a source code repository.

