title: x509 client key credentials for tls virsh qemu uri
body: <p>Ahoi. Implementing libvirt on KVM with TLS for remote virsh (and later terraform). Using a qemu URI everything works fine for client certificates with passwordless keys.
  I.e. <code>virsh qemu://host/system list --all</code> works fine and client cert authentication is good</p>
  <p>Now, we want to use keys with passwords but I don't see an obvious way for passing credentials. (I'm pretty new to this).</p>
  <p>Using libvirtd 4.5.0 on centos-7 on server and libvirt 4.5.0 on centos-7 client side.</p>
  <p>From a quick glance, it looks like libvirt's virnettlscontext at least has a field for x509 credentials in the context (type <code>gnutls_certificate_credentials_t</code>)
  (see <a href="https://github.com/libvirt/libvirt/blob/v4.5.0/src/rpc/virnettlscontext.c" rel="nofollow noreferrer">https://github.com/libvirt/libvirt/blob/v4.5.0/src/rpc/virnettlscontext.c</a>), but I'm unable to find a way to set this from the command line for virsh. My C/Linux foo isn't strong enough to understand the code and how I could utilize it.</p>
  <p>I've tried using an extra param for the remote-uri <code>/system?x509-key-password=&lt;password&gt;</code> -&gt; still says &quot;Decryption has failed&quot;. What am I doing wrong? How cann I pass x509 credentials for the client key for remote qemu sessions?</p>
  <p>The error I receive when using a client key with password is:</p>
  <pre><code>virsh -d4 -c &quot;qemu://&lt;host&gt;/system?x509-key-password=&lt;password&gt;&quot; hostname
  setlocale: No such file or directory
  error: failed to connect to the hypervisor
  error: Unable to set x509 key and certificate: /etc/pki/libvirt/private/clientkey.pem, /etc/pki/libvirt/clientcert.pem: Decryption has failed.
  </code></pre>