def create_rsa_encrypted_pem(private_key, passphrase):
<EOL>securesystemslib.formats.PEMRSA_SCHEMA.check_match(private_key)<EOL>securesystemslib.formats.PASSWORD_SCHEMA.check_match(passphrase)<EOL>if len(private_key):<EOL><INDENT>try:<EOL><INDENT>private_key = load_pem_private_key(private_key.encode('<STR_LIT:utf-8>'),<EOL>password=None, backend=default_backend())<EOL><DEDENT>except ValueError:<EOL><INDENT>raise securesystemslib.exceptions.CryptoError('<STR_LIT>'<EOL>'<STR_LIT>')<EOL><DEDENT><DEDENT>else:<EOL><INDENT>raise ValueError('<STR_LIT>')<EOL><DEDENT>encrypted_pem = private_key.private_bytes(<EOL>encoding=serialization.Encoding.PEM,<EOL>format=serialization.PrivateFormat.TraditionalOpenSSL,<EOL>encryption_algorithm=serialization.BestAvailableEncryption(<EOL>passphrase.encode('<STR_LIT:utf-8>')))<EOL>return encrypted_pem.decode()<EOL>
<Purpose>
  Return a string in PEM format (TraditionalOpenSSL), where the private part
  of the RSA key is encrypted using the best available encryption for a given
  key's backend. This is a curated (by cryptography.io) encryption choice and
  the algorithm may change over time.

  c.f. cryptography.io/en/latest/hazmat/primitives/asymmetric/serialization/
      #cryptography.hazmat.primitives.serialization.BestAvailableEncryption

  >>> public, private = generate_rsa_public_and_private(2048)
  >>> passphrase = 'secret'
  >>> encrypted_pem = create_rsa_encrypted_pem(private, passphrase)
  >>> securesystemslib.formats.PEMRSA_SCHEMA.matches(encrypted_pem)
  True

<Arguments>
  private_key:
    The private key string in PEM format.

  passphrase:
    The passphrase, or password, to encrypt the private part of the RSA
    key.

<Exceptions>
  securesystemslib.exceptions.FormatError, if the arguments are improperly
      formatted.

  securesystemslib.exceptions.CryptoError, if the passed RSA key cannot be
      deserialized by pyca cryptography.

  ValueError, if 'private_key' is unset.


<Returns>
  A string in PEM format (TraditionalOpenSSL), where the private RSA key is
  encrypted. Conforms to 'securesystemslib.formats.PEMRSA_SCHEMA'.