required , in the configuration: [filter "crypt"] clean = openssl enc ... smudge = openssl enc -d ... required Sequence