diff --git a/man/man8/swtpm-localca.conf.8 b/man/man8/swtpm-localca.conf.8
index 9106f52f..b1f02360 100644
--- a/man/man8/swtpm-localca.conf.8
+++ b/man/man8/swtpm-localca.conf.8
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.27 (Pod::Simple 3.20)
+.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.31)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "swtpm-localca.conf 8"
-.TH swtpm-localca.conf 8 "2015-05-03" "swtpm" ""
+.TH swtpm-localca.conf 8 "2018-01-01" "swtpm" ""
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -154,6 +154,9 @@ in this directory.
 .IX Item "signinkey"
 The file containing the key used for signing the certificates. Provide
 a key in \s-1PEM\s0 format.
+.IP "\fBsigningkey_password\fR" 4
+.IX Item "signingkey_password"
+The password to use for the signing key.
 .IP "\fBissuercert\fR" 4
 .IX Item "issuercert"
 The file containing the certificate for this \s-1CA.\s0 Provide a certificate
diff --git a/man/man8/swtpm-localca.conf.pod b/man/man8/swtpm-localca.conf.pod
index 20148fa3..adc8d87b 100644
--- a/man/man8/swtpm-localca.conf.pod
+++ b/man/man8/swtpm-localca.conf.pod
@@ -21,6 +21,10 @@ in this directory.
 The file containing the key used for signing the certificates. Provide
 a key in PEM format.
 
+=item B<signingkey_password>
+
+The password to use for the signing key.
+
 =item B<issuercert>
 
 The file containing the certificate for this CA. Provide a certificate
diff --git a/samples/swtpm-localca b/samples/swtpm-localca
index c0e5cf9e..90000fc4 100755
--- a/samples/swtpm-localca
+++ b/samples/swtpm-localca
@@ -151,6 +151,10 @@ create_cert() {
 		options=$(cat ${LOCALCA_OPTIONS})
 	fi
 
+	if [ -n "${SIGNKEY_PASSWORD}" ]; then
+		options="$options --signkey-password ${SIGNKEY_PASSWORD}"
+	fi
+
 	if [ -n "$vmid" ]; then
 		options="$options --subject \"CN=$vmid\""
 	else
@@ -291,6 +295,10 @@ create_localca_cert() {
 			}
 
 			# now our signing CA
+			if [ -n "${SIGNKEY_PASSWORD}" ]; then
+				export GNUTLS_PIN=${SIGNKEY_PASSWORD}
+			fi
+
 			msg=$(certtool \
 				--generate-privkey \
 				--outfile ${SIGNKEY} \
@@ -452,6 +460,8 @@ main() {
 		logerr "Missing signingkey variable in config file $LOCALCA_CONFIG."
 		exit 1
 	fi
+	SIGNKEY_PASSWORD=$(get_config_value "$LOCALCA_CONFIG" "signingkey_password")
+
 	ISSUERCERT=$(get_config_value "$LOCALCA_CONFIG" "issuercert")
 	if [ -z "$ISSUERCERT" ]; then
 		logerr "Missing issuercert variable in config file $LOCALCA_CONFIG."