diff --git a/cmd/harmony/main.go b/cmd/harmony/main.go
index a20f1dae7..23f453999 100644
--- a/cmd/harmony/main.go
+++ b/cmd/harmony/main.go
@@ -102,6 +102,7 @@ var (
 	enableGC           = flag.Bool("enableGC", true, "Enable calling garbage collector manually .")
 	blsKeyFile         = flag.String("blskey_file", "", "The encrypted file of bls serialized private key by passphrase.")
 	blsPass            = flag.String("blspass", "", "The file containing passphrase to decrypt the encrypted bls file.")
+	blsPassphrase      string
 
 	// logConn logs incoming/outgoing connections
 	logConn = flag.Bool("log_conn", false, "log incoming/outgoing connections")
@@ -182,35 +183,24 @@ func initSetup() {
 }
 
 func setUpConsensusKeyAndReturnIndex(nodeConfig *nodeconfig.ConfigType) (int, *genesis.DeployAccount) {
-	// If FN node running, they should either specify blsPrivateKey or the file with passphrase
-	if *blsKeyFile != "" && *blsPass != "" {
-		passPhrase, err := utils.GetPassphraseFromSource(*blsPass)
-		if err != nil {
-			fmt.Printf("error when reading passphrase file: %v\n", err)
-			os.Exit(100)
-		}
-		consensusPriKey, err := blsgen.LoadBlsKeyWithPassPhrase(*blsKeyFile, passPhrase)
-		if err != nil {
-			fmt.Printf("error when loading bls key, err :%v\n", err)
-			os.Exit(100)
-		}
-		index, acc := genesis.IsBlsPublicKeyIndex(consensusPriKey.GetPublicKey().SerializeToHexStr())
-		if index < 0 {
-			fmt.Println("Can not found your bls key.")
-			os.Exit(100)
-		}
+	consensusPriKey, err := blsgen.LoadBlsKeyWithPassPhrase(*blsKeyFile, blsPassphrase)
+	if err != nil {
+		fmt.Printf("error when loading bls key, err :%v\n", err)
+		os.Exit(100)
+	}
+	index, acc := genesis.IsBlsPublicKeyIndex(consensusPriKey.GetPublicKey().SerializeToHexStr())
+	if index < 0 {
+		fmt.Println("Can not found your bls key.")
+		os.Exit(100)
+	}
 
-		// Consensus keys are the BLS12-381 keys used to sign consensus messages
-		nodeConfig.ConsensusPriKey, nodeConfig.ConsensusPubKey = consensusPriKey, consensusPriKey.GetPublicKey()
-		if nodeConfig.ConsensusPriKey == nil || nodeConfig.ConsensusPubKey == nil {
-			fmt.Println("error to get consensus keys.")
-			os.Exit(100)
-		}
-		return index, acc
+	// Consensus keys are the BLS12-381 keys used to sign consensus messages
+	nodeConfig.ConsensusPriKey, nodeConfig.ConsensusPubKey = consensusPriKey, consensusPriKey.GetPublicKey()
+	if nodeConfig.ConsensusPriKey == nil || nodeConfig.ConsensusPubKey == nil {
+		fmt.Println("error to get consensus keys.")
+		os.Exit(100)
 	}
-	fmt.Println("Internal nodes need to have pass to decrypt blskey")
-	os.Exit(101)
-	return -1, nil
+	return index, acc
 }
 
 func createGlobalConfig() *nodeconfig.ConfigType {
@@ -393,6 +383,18 @@ func main() {
 	flag.Var(&utils.BootNodes, "bootnodes", "a list of bootnode multiaddress (delimited by ,)")
 	flag.Parse()
 
+	// If FN node running, they should either specify blsPrivateKey or the file with passphrase
+	if *blsKeyFile == "" || *blsPass == "" {
+		fmt.Println("Internal nodes need to have pass to decrypt blskey")
+		os.Exit(101)
+	}
+	passphrase, err := utils.GetPassphraseFromSource(*blsPass)
+	if err != nil {
+		fmt.Printf("error when reading passphrase file: %v\n", err)
+		os.Exit(100)
+	}
+	blsPassphrase = passphrase
+
 	// Configure log parameters
 	utils.SetLogContext(*port, *ip)
 	utils.SetLogVerbosity(log.Lvl(*verbosity))
diff --git a/internal/utils/passphrase.go b/internal/utils/passphrase.go
index 7cc16599a..fe6b7b6df 100644
--- a/internal/utils/passphrase.go
+++ b/internal/utils/passphrase.go
@@ -37,6 +37,12 @@ func readAllAsString(r io.Reader) (data string, err error) {
 //
 // The source can be "pass:password", "env:var", "file:pathname", "fd:number",
 // or "stdin".  See “PASS PHRASE ARGUMENTS” section of openssl(1) for details.
+//
+// When "stdin" or "fd:" is used,
+// the standard input or the given file descriptor is exhausted.
+// Therefore, this function should be called at most once per program
+// invocation; the second call, if any, may return an empty string if "stdin"
+// or "fd" is used.
 func GetPassphraseFromSource(src string) (pass string, err error) {
 	switch src {
 	case "stdin":