Why does openssl print to stderr for a successful command?

Question

When I generate a CSR using openssl, the normal output goes to stderr. I don't understand why it isn't on stdout. I'm scripting the generation of some certificate/key pairs and want to be able to detect error conditions, but this confuses the issue.

admin@ip-10-248-185-66:~> openssl req -rand $RAND -new -newkey rsa:2048 -nodes -keyout $KEYPATH -subj /C=US/ST=CA/L=LA/O=TS/OU=server/CN=primary -out $CSRPATH -config $CONFPATH
Generating a 2048 bit RSA private key
.........................+++
..................................+++
writing new private key to '$KEYPATH'
-----
admin@ip-10-248-185-66:~> echo $?
0
admin@ip-10-248-185-66:~> openssl req -rand $RAND -new -newkey rsa:2048 -nodes -keyout $KEYPATH -subj /C=US/ST=CA/L=LA/O=TS/OU=server/CN=primary -out $CSRPATH -config $CONFPATH 2>/dev/null
admin@ip-10-248-185-66:~>

Answer 1

Messages to the users go on stderr. What goes to stdout is the result of the openssl command.

By default, unless you use -in or -out, openssl takes data (keys, certificates...) in from stdin and writes data out on stdout (the result like the request pem file).

In a shell you typically use it as:

openssl cmd < in.pem > out.pem

You don't want the messages to the user to end up in out.pem which is why they are issued on stderr.