How to Check if *.pem is Password Protected Using ssh-keygen

To change the passphrase on your default key:

$ ssh-keygen -p

If you need to specify a key, pass the -f option:

$ ssh-keygen -p -f ~/.ssh/id_dsa

then provide your old and new passphrase (twice) at the prompts. (Use ~/.ssh/id_rsa if you have an RSA key.)

More details from man ssh-keygen:

[...]
SYNOPSIS
    ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
               [-f output_keyfile]
    ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
[...]
     -f filename
             Specifies the filename of the key file.
[...]
     -N new_passphrase
             Provides the new passphrase.

     -P passphrase
             Provides the (old) passphrase.

     -p      Requests changing the passphrase of a private key file instead of
             creating a new private key.  The program will prompt for the file
             containing the private key, for the old passphrase, and twice for
             the new passphrase.
[...]

The definitely easiest way to setup the ssh key is to use command

ssh-copy-id -i ~/.ssh/id_rsa.pub account@yourserver.com

If even that fails, then you have something odd in your sshd_config we need to take care of.

EDIT: So it was something wrong with your sshd_config, after all.

Change this:

 #PermitRootLogin yes

to be

 PermitRootLogin without-password

So only key authentication for root is allowed. Or, if you want to run only specific commands, forced-commands-only would be even better option, but before going that far, make this work with the without-password option.

Anyway, after that change restart your sshd and see how things just start to work!