OpenRC service needs password to unlock certificate

I'm making my own service which communicates using sockets and SSL. It needs a certificate to work, but the certificate is currently locked behind a password. I can think of two ways to fix this. Either make the certificate not require a password. Or store the password to the certificate in a separate file, which the service can read in order to unlock the certificate. Both options feel like a bad idea. What is best practice here? Also, I'm using OpenRC not systemd.