When I tried to run the following command to issue a new private key, which I use to host my web app via SSL:

openssl genrsa -out example.key 2048

the following error occured:

unable to write 'random state'  
e is 65537 (0x10001)

After digging out on the Web, I found a solution, which instructs you to delete the ~/.rnd file, which is likely owned by root.

sudo rm ~/.rnd

However, I found you don't need to delete the ~/.rnd if you issue the openssl command with sudo.

So my question is:

  • what is the ~/.rnd and why does it exist in my environment?

  • Which is a better way to issue a new private key?

  • 4
    ~/.rnd should be owned by the user of the home directory. It should only be owned by root if it's root's /root/.rnd. The wrong ownership would explain the "unable to write error".
    – jscott
    Feb 1 '17 at 14:57
  • @jscott Yeah I know. My question is why it has been created as root (and what it does), which seems to be true as well of people in the linked question.
    – Blaszard
    Feb 1 '17 at 15:01
  • 2
    It seems the obvious guess would be "root created the file or chownd it for some reason." -- that part would be for you to solve. None of the user profiles I checked here have it owned by root. The file is somewhat detailed in man 1 sslrand.
    – jscott
    Feb 1 '17 at 15:12

The ~/.rnd file is owned by root if you've ever run a command that modifies ~/.rnd as root via sudo in its non-login mode (ie without -i). As for what the ~/.rnd file is, it contains a seed value for the OpenSSL random number generator. The least-worst docs I can find on it are the RAND_read_file(3) man page.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.