164

I have installed OpenSSL 64. I want to use a certificate for my nodejs https server. I ran the following command:

openssl genrsa -out subdomain.domain.com.key 1024

But I have got the error:

WARNING: can't open config file: /usr/local/ssl/openssl.cnf
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
.........++++++
.........................................++++++
unable to write 'random state'
e is 65537 (0x10001)

How can I resolve it?
Is this the right command?

2

7 Answers 7

293

The solution is running this command:

set OPENSSL_CONF=C:\OpenSSL-Win32\bin\openssl.cfg   

or

set OPENSSL_CONF=[path-to-OpenSSL-install-dir]\bin\openssl.cfg

in the command prompt before using openssl command.

Let openssl know for sure where to find its .cfg file.

Alternatively you could set the same variable OPENSSL_CONF in the Windows environment variables.

NOTE: This can happen when using the OpenSSL binary distribution from Shining Light Productions (a compiled + installer version of the official OpenSSL that is free to download & use). This distribution is "semi-officially" linked from OpenSSL's site as a "service primarily for operating systems where there are no pre-compiled OpenSSL packages".

8
  • 1
    Make sure you create a user variable. In my case, creating a system var doesn't fix the issue.
    – birken25
    Apr 4, 2016 at 20:20
  • 3
    Does not work and I've checked the OPENSSL_CONF var in the console and it's set. May 4, 2017 at 22:06
  • 2
    If you are using a path with spaces, try wrapping it with quotes: set "OPENSSL_CONF=C:\OpenSSL Win32\bin 123\openssl.cfg"
    – NoOne
    Mar 11, 2018 at 19:36
  • Also note that, as most cross-platform open-source crapyware do, having unicode characters in the path will create problems.
    – NoOne
    Mar 11, 2018 at 19:39
  • 2
    I had to change cfg in the above command to cnf Oct 4, 2022 at 16:52
24

I've SSL on Apache2.4.4 and executing this code at first, did the trick:
set OPENSSL_CONF=C:\wamp\bin\apache\Apache2.4.4\conf\openssl.cnf

then execute the rest codes..

1
  • This worked for me on Windows 2008 R2 with Win64OpenSSL_Light-1_1_0c +1 Nov 23, 2016 at 11:52
11

/usr/local/ssl/openssl.cnf

A path like this means the program has been compiled with either Cygwin or MSYS. If you must use this openssl then you will need an interpreter that understands those paths, like Bash, which is provided by Cygwin or MSYS.

Another option would be to download or compile a Windows Native version of openssl. Using that the program would instead require a path like

C:\Users\Steven\ssl\openssl.cnf

which would be better suited for the Command Prompt.

1
  • No. I think it means it was compiled with OPENSSLDIR: "/usr/local/ssl". Mine was compiled with cl.exe openssl version -f compiler: cl -D_USING_V110_SDK71_ [..]. May 4, 2017 at 22:10
7

In my case I used the binaries from Shining Light and the environment variables were already updated. But still had the issue until I ran a command window with elevated privileges.

When you open the CMD window be sure to run it as Administrator. (Right click the Command Prompt in Start menu and choose "Run as administrator")

I think it can't read the files due to User Account Control.

1
  • 1
    Running the commands as Administrator and doing set OPENSSL_CONF= fixed the problem for me. Thanks! Jul 22, 2019 at 19:42
7

SOLUTION!

just set -config parameter location correctly, i.e :

openssl ....................  -config C:\bin\apache\apache2.4.9\conf\openssl.cnf
2
  • 5
    This works for "openssl req" but not for "openssl pkcs12". The environment variable worked for both. It is strange that the pkcs12 option does not include the -config switch.
    – GarDavis
    Feb 28, 2016 at 22:32
  • Funny... openssl req ignores -config here (Apache/2.4.10 Win64) but setting OPENSSL_CONF works fine. Feb 24, 2017 at 14:47
3

Not sure what is the difference between .cfg & .cnf In my server I couldn't find .cfg or .cnf I had created a new file for the same and placed it in the following folder /usr/local/ssl/bin

executed the

.\openssl genrsa -des3 -out <key name>.key 2048 

went great..

1

Simply install Win64 OpenSSL v1.0.2a or Win32 OpenSSL v1.0.2a, you can download these from http://slproweb.com/products/Win32OpenSSL.html. Works out of the box, no configuration needed.

1
  • 1
    That's where I downloaded from, and was going to say that it has the problem described by the OP, but after following advice (from Xero accounting) to restart the computer after installing, I found that it worked with no issues.
    – Jon
    Jun 3, 2016 at 16:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.