How do I make OpenSSL write the RANDFILE on Windows Vista?

Question

When I run:

openssl genrsa -out mykey.key 2048

I get the following error:

unable to write 'random state'
    e is 65537 (0x10001)

My googling suggests this is some kind of Vista permissions issue. How can I allow Vista to write this file or how can I configure openssl to get round it?

Answer 1

The root issue is that the RANDFILE variable in the OpenSSL configuration file is ignored on Windows. This has been a long-standing problem that continues to exist as of the OpenSSL v1.0a release, regardless of whether the target Windows platform is x86 or x64.

There is a delightfully simple solution, though. Merely use a regular environmental var to set the RANDFILE value, like

set RANDFILE=.rnd

Because this value is ephemeral, it must be re-issued for every new DOS box, or scripted in a batch file.

Answer 2

I found this that might help: Using OpenSSL what does "unable to write 'random state'" mean?

also, here: http://adamyoung.net/OpenSSL-unable-to-write-random-state

there is a suggestion here http://www.mail-archive.com/[email protected]/msg51344.html on how to get it working in vista.

find the location of cmd.exe, right click and run as administrator

Answer 3

I had the same issue but for Windows 7. Easily solved, I created a system Environment Variable called HOME and set it to the directory I wanted my .rnd file in. This solved the issue because OpenSSL didn't know where my .rnd file was (because I didn't have one) and it didn't know where to put it if it was to create it. As soon as I set my environment variable HOME with a directory (c:\ is fine!) I reran my key generation in OpenSSL and it worked straight off. To verify, I checked the key I had created and it had proper content. I also checked the directory I set my HOME environment variable to, and lo and behold a .rnd file was sat there! Hope this helps someone :-)