diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template
index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644
--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -1083,6 +1083,7 @@
 # puma['ssl_certificate_key'] = nil
 # puma['ssl_client_certificate'] = nil
 # puma['ssl_cipher_filter'] = nil
+# puma['ssl_key_password_command'] = nil
 # puma['ssl_verify_mode'] = 'none'
 
 # puma['pidfile'] = '/opt/gitlab/var/puma/puma.pid'
diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb
index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644
--- a/files/gitlab-cookbooks/gitlab/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb
@@ -569,6 +569,7 @@
 default['gitlab']['puma']['ssl_certificate_key'] = nil
 default['gitlab']['puma']['ssl_client_certificate'] = nil
 default['gitlab']['puma']['ssl_cipher_filter'] = nil
+default['gitlab']['puma']['ssl_key_password_command'] = nil
 default['gitlab']['puma']['ssl_verify_mode'] = 'none'
 default['gitlab']['puma']['prometheus_scrape_scheme'] = 'http'
 default['gitlab']['puma']['prometheus_scrape_tls_server_name'] = nil
diff --git a/files/gitlab-cookbooks/gitlab/recipes/puma.rb b/files/gitlab-cookbooks/gitlab/recipes/puma.rb
index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9wdW1hLnJi..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9wdW1hLnJi 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/puma.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/puma.rb
@@ -38,6 +38,7 @@
 puma_ssl_port = node['gitlab'][svc]['ssl_port']
 puma_ssl_cert = node['gitlab'][svc]['ssl_certificate']
 puma_ssl_key = node['gitlab'][svc]['ssl_certificate_key']
+puma_ssl_key_password_command = node['gitlab'][svc]['ssl_key_password_command']
 puma_ssl_client_cert = node['gitlab'][svc]['ssl_client_certificate']
 puma_ssl_cipher_filter = node['gitlab'][svc]['ssl_cipher_filter']
 puma_ssl_verify_mode = node['gitlab'][svc]['ssl_verify_mode']
@@ -85,6 +86,7 @@
   ssl_certificate_key puma_ssl_key
   ssl_cipher_filter puma_ssl_cipher_filter
   ssl_client_certificate puma_ssl_client_cert
+  ssl_key_password_command puma_ssl_key_password_command
   ssl_verify_mode puma_ssl_verify_mode
   worker_timeout node['gitlab'][svc]['worker_timeout']
   per_worker_max_memory_mb node['gitlab'][svc]['per_worker_max_memory_mb']
diff --git a/files/gitlab-cookbooks/gitlab/resources/puma_config.rb b/files/gitlab-cookbooks/gitlab/resources/puma_config.rb
index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVzb3VyY2VzL3B1bWFfY29uZmlnLnJi..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVzb3VyY2VzL3B1bWFfY29uZmlnLnJi 100644
--- a/files/gitlab-cookbooks/gitlab/resources/puma_config.rb
+++ b/files/gitlab-cookbooks/gitlab/resources/puma_config.rb
@@ -16,6 +16,7 @@
 property :ssl_certificate_key, [String, nil], default: nil
 property :ssl_client_certificate, [String, nil], default: nil
 property :ssl_cipher_filter, [String, nil], default: nil
+property :ssl_key_password_command, [String, nil], default: nil
 property :ssl_verify_mode, String, default: 'none'
 property :working_directory, [String, nil], default: nil
 property :worker_timeout, Integer, default: 60
diff --git a/files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb b/files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb
index 88bea4d78df8db508575d63eac96326d8bd5a8f2_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvcHVtYS5yYi5lcmI=..49eee51403780dbb1a6a18410bfe7d69bcf025f3_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvcHVtYS5yYi5lcmI= 100644
--- a/files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb
+++ b/files/gitlab-cookbooks/gitlab/templates/default/puma.rb.erb
@@ -50,6 +50,9 @@
   <%- if @ssl_certificate_key %>
   key: '<%= @ssl_certificate_key %>',
   <%- end %>
+  <%- if @ssl_key_password_command %>
+  key_password_command: '<%= @ssl_key_password_command %>',
+  <%- end %>
   <%- if @ssl_client_certificate %>
   ca: '<%= @ssl_client_certificate %>',
   <%- end %>
diff --git a/spec/chef/cookbooks/gitlab/recipes/puma_spec.rb b/spec/chef/cookbooks/gitlab/recipes/puma_spec.rb
index 88bea4d78df8db508575d63eac96326d8bd5a8f2_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9wdW1hX3NwZWMucmI=..49eee51403780dbb1a6a18410bfe7d69bcf025f3_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9wdW1hX3NwZWMucmI= 100644
--- a/spec/chef/cookbooks/gitlab/recipes/puma_spec.rb
+++ b/spec/chef/cookbooks/gitlab/recipes/puma_spec.rb
@@ -137,7 +137,8 @@
           ssl_listen: '192.168.0.1',
           ssl_port: 9999,
           ssl_certificate: '/tmp/test.crt',
-          ssl_certificate_key: '/tmp/test.key'
+          ssl_certificate_key: '/tmp/test.key',
+          ssl_key_password_command: 'echo mypassword'
         }
       }
     end
@@ -149,6 +150,9 @@
 
     it 'renders the puma.rb file' do
       expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with(
+        ssl_certificate: '/tmp/test.crt',
+        ssl_certificate_key: '/tmp/test.key',
+        ssl_key_password_command: 'echo mypassword',
         ssl_listen_host: '192.168.0.1',
         ssl_port: 9999,
         listen_socket: '/tmp/puma.socket',
@@ -159,7 +163,7 @@
       )
 
       expect(chef_run).to render_file('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with_content { |content|
-        expect(content).to match(/ssl_bind '192.168.0.1', 9999, {\n  cert: '\/tmp\/test.crt',\n  key: '\/tmp\/test.key',\n  verify_mode: 'none'\n}/m)
+        expect(content).to match(/ssl_bind '192.168.0.1', 9999, {\n  cert: '\/tmp\/test.crt',\n  key: '\/tmp\/test.key',\n  key_password_command: 'echo mypassword',\n  verify_mode: 'none'\n}/m)
       }
     end
 
@@ -186,10 +190,11 @@
             ssl_listen: '192.168.0.1',
             ssl_port: 9999,
             ssl_certificate: '/tmp/test.crt',
-            ssl_certificate_key: '/tmp/test.key'
+            ssl_certificate_key: '/tmp/test.key',
+            ssl_key_password_command: nil
           }
         }
       end
 
       it 'omits the UNIX socket and TCP binds from the Puma config' do
         expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with(
@@ -190,9 +195,12 @@
           }
         }
       end
 
       it 'omits the UNIX socket and TCP binds from the Puma config' do
         expect(chef_run).to create_puma_config('/var/opt/gitlab/gitlab-rails/etc/puma.rb').with(
+          ssl_certificate: '/tmp/test.crt',
+          ssl_certificate_key: '/tmp/test.key',
+          ssl_key_password_command: nil,
           ssl_listen_host: '192.168.0.1',
           ssl_port: 9999,
           listen_socket: '',
@@ -218,6 +226,7 @@
         base_params.tap do |config|
           config[:puma][:ssl_client_certificate] = client_cert
           config[:puma][:ssl_cipher_filter] = filter
+          config[:puma][:ssl_key_password_command] = nil
           config[:puma][:ssl_verify_mode] = 'peer'
         end
       end
@@ -228,6 +237,7 @@
           ssl_port: 9999,
           listen_socket: '/tmp/puma.socket',
           listen_tcp: '10.0.0.1:9000',
+          ssl_client_certificate: client_cert,
           ssl_cipher_filter: filter,
           worker_processes: 4,
           min_threads: 5,