After some debugging with rd.shell=1 kernel command line, I agree to comment #c5. An example: I specified "rd.luks.key=/stick.key:/dev/sda1" on kernel command line. (I used /dev/sda1 because I don't want to use long /dev/disk filenames here.) The file /tmp/luks.keys is generated correctly in Initrd: *:/dev/sda1:/stick.key /etc/crypttab in Initrd: cr_md0 /dev/md0 none none systemd-cryptsetup-generator had generated a file /run/systemd/generator/systemd-cryptsetup@cr_md0.service. It contains [...] ExecStart=/usr/lib/systemd/systemd-cryptsetup attach 'cr_md0' '/dev/md0' 'none' 'none' If I run the "ExecStart" command manually, I get a password prompt. This is a problem. dracut:/# /usr/lib/systemd/systemd-cryptsetup attach 'cr_md0' '/dev/md0' 'none' 'none' Please enter passphrase for disk cr_md0! The correct steps should look like this: dracut:/# mkdir -m 0755 /mnt/testdev1 dracut:/# mount /dev/sda1 /mnt/testdev1 dracut:/# /usr/lib/systemd/systemd-cryptsetup attach 'cr_md0' '/dev/md0' '/mnt/testdev1/stick.key' 'none'