OAT onsocssl needs a password?

I'm using IDS 11.50 on HPUX 11, and have successfully used the GSK to configure a serveralias to encrypt with onsocssl and a self-signed certificate with a generic PC client, WinSQL. In order to secure OAT, I've modified the file "template_admin.php" as described in https://www.ibm.com/developerworks/blogs/resources/idsteam/OAT_ONSOCSSL.pdf. When I attempt to connect with OAT after bouncing the webserver, though, I get this error message: Connection Failed: DSN:informix:host=hostname;service=1565;database=sysmaster;protocol=onsocssl;server=hostlab4_ssl SQLSTATE=HY000, SQLDriverConnect: -28014 [Informix][Informix ODBC Driver][Informix]Secure Sockets Layer error: GSK_ERROR_BAD_KEYFILE_PASSWORD. Is a password needed (unlike with the prior ODBC connection I'd successfully created) to access the keystore using OAT? Does anyone know how to include it? Or perhaps the error itself is specious? I'll tell you the OAT version when you tell me how to find it.