diff --git a/library/x509parse.c b/library/x509parse.c
index bfc4b58..f26b433 100644
--- a/library/x509parse.c
+++ b/library/x509parse.c
@@ -63,6 +63,9 @@
 #endif
 #include "polarssl/dhm.h"
 #include "polarssl/pkcs12.h"
+#if defined(POLARSSL_PKCS5_C)
+#include "polarssl/pkcs5.h"
+#endif
 
 #include <string.h>
 #include <stdlib.h>
@@ -2194,6 +2197,9 @@
     p = (unsigned char *) key;
     end = p + keylen;
 
+    if( pwdlen == 0 )
+        return( POLARSSL_ERR_X509_PASSWORD_REQUIRED );
+
     /*
      * This function parses the EncryptedPrivatKeyInfo object (PKCS#8)
      *
@@ -2277,6 +2283,19 @@
             return( ret );
         }
     }
+#if defined(POLARSSL_PKCS5_C)
+    else if( OID_CMP( OID_PKCS5_PBES2, &pbe_alg_oid ) )
+    {
+        if( ( ret = pkcs5_pbes2( &pbe_params, PKCS5_DECRYPT, pwd, pwdlen,
+                                  p, len, buf ) ) != 0 )
+        {
+            if( ret == POLARSSL_ERR_PKCS5_PASSWORD_MISMATCH )
+                return( POLARSSL_ERR_X509_PASSWORD_MISMATCH );
+
+            return( ret );
+        }
+    }
+#endif /* POLARSSL_PKCS5_C */
     else
         return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE );
 
@@ -2376,14 +2395,22 @@
     }
 
     rsa_free( rsa );
+
+    if( ret == POLARSSL_ERR_X509_PASSWORD_MISMATCH )
+    {
+        return( ret );
+    }
+
     if( ( ret = x509parse_key_pkcs8_unencrypted_der( rsa, key, keylen ) ) == 0 )
         return( 0 );
 
     rsa_free( rsa );
+
     if( ( ret = x509parse_key_pkcs1_der( rsa, key, keylen ) ) == 0 )
         return( 0 );
 
     rsa_free( rsa );
+
     return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT );
 }