What are the implications of an encrypted private key being released? An application owner at my organization requested a java keystore to be built around specific parameters and provide them with both the JKS and pkcs12 versions of the keystore.  Weeks later and after many changes they were troubleshooting some issues.  The application admin, not thinking of the security implications, blasts an email with the output of the OpenSSL command: pkcs12 -info -in .

In the output of that command the first key listed shows.

-----BEGIN ENCRYPTED PRIVATE KEY-----
blahblahblahblahblah
-----END ENCRYPTED PRIVATE KEY-----

To me this looks nuclear and appears to expose the private key.  My recommendation initially is to burn the entire keystore and start over rekeying everything.  As this is a significant amount of work I wanted to be sure my reaction was accurate.  It does say Encrypted so perhaps as long as the password is still secure maybe we're okay?  I'm pretty solid on OpenSSL and keytool but this slips past my expertise.  Can anyone here help me define the exposure for my mangement?
Since the encrypted key file is (potentially) leaked, and adversary is able to run an offline dictionary attack against your key. So you have to answer the question: Is the strength of the password used to encrypt the key, weaker than the strength of the key itself?

So what you should do, is calculate the strength (entropy) of your password (KeePass can do this, for instance) and compare it to current strength estimations for the itself (RSA 2048 has 112 bits, for example). If the password's result is weaker then the key, you should drop it and revoke the certificate.