OAT onsocssl needs a password?

[red_v...@yahoo.com]

I'm using IDS 11.50 on HPUX 11, and have successfully used the GSK to
configure a serveralias to encrypt with onsocssl and a self-signed
certificate with a generic PC client, WinSQL. In order to secure OAT,
I've modified the file "template_admin.php" as described in
https://www.ibm.com/developerworks/blogs/resources/idsteam/OAT_ONSOCSSL.pdf.
When I attempt to connect with OAT after bouncing the webserver,
though, I get this error message:

Connection Failed:
DSN:informix:host=hostname;service=1565;database=sysmaster;protocol=onsocssl;server=hostlab4_ssl
SQLSTATE=HY000, SQLDriverConnect: -28014 [Informix][Informix ODBC
Driver][Informix]Secure Sockets Layer error:
GSK_ERROR_BAD_KEYFILE_PASSWORD.

Is a password needed (unlike with the prior ODBC connection I'd
successfully created) to access the keystore using OAT? Does anyone
know how to include it? Or perhaps the error itself is specious?
I'll tell you the OAT version when you tell me how to find it.