Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I generate a CSR using openssl, the normal output goes to stderr. I don't understand why it isn't on stdout. I'm scripting the generation of some certificate/key pairs and want to be able to detect error conditions, but this confuses the issue.

admin@ip-10-248-185-66:~> openssl req -rand $RAND -new -newkey rsa:2048 -nodes -keyout $KEYPATH -subj /C=US/ST=CA/L=LA/O=TS/OU=server/CN=primary -out $CSRPATH -config $CONFPATH
Generating a 2048 bit RSA private key
writing new private key to '$KEYPATH'
admin@ip-10-248-185-66:~> echo $?
admin@ip-10-248-185-66:~> openssl req -rand $RAND -new -newkey rsa:2048 -nodes -keyout $KEYPATH -subj /C=US/ST=CA/L=LA/O=TS/OU=server/CN=primary -out $CSRPATH -config $CONFPATH 2>/dev/null
share|improve this question
Thats probably best asked the developers. However: All my programs output everything that is not actual data to stderr. The reason is that I usually print the result on stdout and this should be separate from logging. – Fabian May 21 '14 at 20:30
up vote 3 down vote accepted

Messages to the users go on stderr. What goes to stdout is the result of the openssl command.

By default, unless you use -in or -out, openssl takes data (keys, certificates...) in from stdin and writes data out on stdout (the result like the request pem file).

In a shell you typically use it as:

openssl cmd < in.pem > out.pem

You don't want the messages to the user to end up in out.pem which is why they are issued on stderr.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.