Error when creating self-signed SSL certificate

Question

I am trying to create a self-signed SSL certificate using OpenSSL (the version that comes with Apache 2.2 + mod_ssl). The OpenSSL binaries are in C:\Web\Apache2.2\bin, and the configuration file I am using is C:\Web\Apache2.2\conf\openssl.cnf. I have executed the following commands:

(I will use newlines to make it more readable.)

openssl req -config ..\conf\openssl.cnf -new -out ..\conf\eduardo.csr
        -keyout ..\conf\eduardo.pem
# Then I entered country code, province, city, etc.
# This step worked correctly.

openssl rsa -in ..\conf\eduardo.pem -out ..\conf\eduardo.key
# Then I entered my pass phrase.

openssl x509 -in ..\conf\eduardo.csr -out ..\conf\eduardo.cert
        -req -signkey ..\conf\eduardo.key -days 1000000

And, when executing the last step, I got the following output:

Loading 'screen' into random state - done
Signature ok
subject=/C=PE/ST=Lima/L=Lima/...
Getting Private Key
unable to write 'random state' <--

What does that error mean, and how can I fix it?

Answer 1

openssl tries to write the 'random state' to a file, but the permissions of the directory it is using do not allow to create the file. See:

http://www.openssl.org/support/faq.cgi#USER2

Answer 2

1. Initially you need to open command prompt in administrator mode.

Then do the following,

2. cd to_the_certificate_path_folder
3. set OPENSSL_CONF="C:\OpenSSL-Win32\bin\openssl.cfg"

4. set RANDFILE="D:\path_to_certs\.rnd" Here if you set RANDFILE path without mentioning .rnd then it given message "Unable to write random state" and openssl didn't create .rnd random state to a file.

5. C:\OpenSSL-Win32\bin\openssl.exe

6. OpenSSL> genrsa -out ca.key

It worked for me.

Answer 3

For me, on a Windows Server, the solution for this was simply to make sure the command prompt was opened via "Run as Administrator"