make fifo: `mkfifo -m 600 /path/to/fifo`

/etc/nginx/sites-enabled/site
```
[CUT]
	ssl_certificate		/path/to/cert;
	ssl_password_file       /path/to/fifo;
	ssl_certificate_key	/path/to/key;
[CUT]
```

/lib/systemd/system/sslpass.service
```
[Unit]
Description=SSL Passphrase Shim
[Service]
Type=simple
ExecStart=/bin/bash -c 'echo -n `systemd-ask-password "Enter SSL Passphrase: "` > /etc/nginx/sslpass'
#Restart=always
[Install]
WantedBy=nginx.service
```

Then `systemctl daemon-reload && systemctl enable sslpass.service`