The failure was due to my PKCS#8 private key format:
- With a PKCS#8 private key
-----BEGIN ENCRYPTED PRIVATE KEY-----
header
or
-----BEGIN PRIVATE KEY-----
header
curl+openssl works, but not curl+nss+libnsspem.so
- With a RSA private key
-----BEGIN RSA PRIVATE KEY-----
header
both curl+openssl and curl+nss+libnsspem.so work.
So use this command openssl rsa -in key.pem -out newkey.pem
to remove the pass phrase on an RSA private key: