diff --git a/lib/pki_evp.cpp b/lib/pki_evp.cpp
index a1c9e060..2fc88ab2 100644
--- a/lib/pki_evp.cpp
+++ b/lib/pki_evp.cpp
@@ -665,6 +665,61 @@ QSqlError pki_evp::deleteSqlData()
 	return q.lastError();
 }
 
+bool pki_evp::pem_format(BioByteArray &b, exportType::etype format)
+{
+	EVP_PKEY *pkey;
+	int keytype;
+
+	switch (format) {
+	case exportType::PEM_private:
+	case exportType::SSH2_private:
+		pkey = decryptKey();
+		keytype = EVP_PKEY_id(pkey);
+		switch (keytype) {
+		case EVP_PKEY_RSA:
+			PEM_write_bio_RSAPrivateKey(b,
+				EVP_PKEY_get0_RSA(pkey),
+				NULL, NULL, 0, NULL, NULL);
+			break;
+		case EVP_PKEY_DSA:
+			PEM_write_bio_DSAPrivateKey(b,
+				EVP_PKEY_get0_DSA(pkey),
+				NULL, NULL, 0, NULL, NULL);
+			break;
+#ifndef OPENSSL_NO_EC
+		case EVP_PKEY_EC:
+			PEM_write_bio_ECPrivateKey(b,
+				EVP_PKEY_get0_EC_KEY(pkey),
+				NULL, NULL, 0, NULL, NULL);
+			break;
+#ifdef EVP_PKEY_ED25519
+		case EVP_PKEY_ED25519:
+			if (format == exportType::PEM_private)
+				return false;
+			write_SSH2_ed25519_private(b, pkey, NULL);
+			break;
+#endif
+#endif
+		}
+		EVP_PKEY_free(pkey);
+		break;
+	case exportType::PKCS8:
+		pkey = decryptKey();
+		PEM_write_bio_PrivateKey(b, pkey, NULL, NULL, 0, NULL, NULL);
+		EVP_PKEY_free(pkey);
+		break;
+	case exportType::PKCS8_encrypt:
+		pkey = decryptKey();
+		PEM_write_bio_PrivateKey(b, pkey, EVP_aes_256_cbc(),
+					 passwd.constUchar(), passwd.size(),
+					 NULL, NULL);
+		EVP_PKEY_free(pkey);
+		break;
+	default:
+		return pki_key::pem_format(b, format);
+	}
+	return true;
+}
 void pki_evp::writePKCS8(XFile &file, const EVP_CIPHER *enc,
 		pem_password_cb *cb, bool pem) const
 {
diff --git a/lib/pki_evp.h b/lib/pki_evp.h
index e80e3cb0..6afe4e3a 100644
--- a/lib/pki_evp.h
+++ b/lib/pki_evp.h
@@ -57,6 +57,7 @@ class pki_evp: public pki_key
 		static QString removeTypeFromIntName(QString n);
 		void fromPEMbyteArray(const QByteArray &ba, const QString &name);
 		void fload(const QString &fname);
+		bool pem_format(BioByteArray &, exportType::etype format);
 		EVP_PKEY *load_ssh_ed25519_privatekey(const QByteArray &ba,
 						const pass_info &p);
 		void writeDefault(const QString &dirname) const;
diff --git a/lib/pki_key.cpp b/lib/pki_key.cpp
index c854e817..16dc3797 100644
--- a/lib/pki_key.cpp
+++ b/lib/pki_key.cpp
@@ -125,51 +125,10 @@ void pki_key::write_SSH2_ed25519_private(BIO *b,
 
 bool pki_key::pem(BioByteArray &b, int format)
 {
-	EVP_PKEY *pkey;
-	QByteArray ba;
-	int keytype;
-
 	switch (format) {
 	case exportType::SSH2_public:
 		b += SSH2publicQByteArray();
 		break;
-	case exportType::PEM_private:
-	case exportType::SSH2_private:
-		pkey = decryptKey();
-		keytype = EVP_PKEY_id(pkey);
-		switch (keytype) {
-		case EVP_PKEY_RSA:
-			PEM_write_bio_RSAPrivateKey(b,
-				EVP_PKEY_get0_RSA(pkey),
-				NULL, NULL, 0, NULL, NULL);
-			break;
-		case EVP_PKEY_DSA:
-			PEM_write_bio_DSAPrivateKey(b,
-				EVP_PKEY_get0_DSA(pkey),
-				NULL, NULL, 0, NULL, NULL);
-			break;
-#ifndef OPENSSL_NO_EC
-		case EVP_PKEY_EC:
-			PEM_write_bio_ECPrivateKey(b,
-				EVP_PKEY_get0_EC_KEY(pkey),
-				NULL, NULL, 0, NULL, NULL);
-			break;
-#ifdef EVP_PKEY_ED25519
-		case EVP_PKEY_ED25519:
-			if (format == exportType::PEM_private)
-				return false;
-			write_SSH2_ed25519_private(b, pkey, NULL);
-			break;
-#endif
-#endif
-		}
-		EVP_PKEY_free(pkey);
-		break;
-	case exportType::PKCS8:
-		pkey = decryptKey();
-		PEM_write_bio_PrivateKey(b, pkey, NULL, NULL, 0, NULL, NULL);
-		EVP_PKEY_free(pkey);
-		break;
 	case exportType::PEM_key:
 		PEM_write_bio_PUBKEY(b, key);
 		break;
diff --git a/lib/pki_key.h b/lib/pki_key.h
index 2144e2c9..de93aebc 100644
--- a/lib/pki_key.h
+++ b/lib/pki_key.h
@@ -13,6 +13,7 @@
 #include <openssl/pem.h>
 #include <openssl/evp.h>
 #include "pki_base.h"
+#include "exportType.h"
 #include "builtin_curves.h"
 
 #define PEM_STRING_OPENSSH_KEY "OPENSSH PRIVATE KEY"