When I generate a CSR using openssl, the normal output goes to stderr. I don't understand why it isn't on stdout. I'm scripting the generation of some certificate/key pairs and want to be able to detect error conditions, but this confuses the issue.

admin@ip-10-248-185-66:~> openssl req -rand $RAND -new -newkey rsa:2048 -nodes -keyout $KEYPATH -subj /C=US/ST=CA/L=LA/O=TS/OU=server/CN=primary -out $CSRPATH -config $CONFPATH
Generating a 2048 bit RSA private key
writing new private key to '$KEYPATH'
admin@ip-10-248-185-66:~> echo $?
admin@ip-10-248-185-66:~> openssl req -rand $RAND -new -newkey rsa:2048 -nodes -keyout $KEYPATH -subj /C=US/ST=CA/L=LA/O=TS/OU=server/CN=primary -out $CSRPATH -config $CONFPATH 2>/dev/null
  • Thats probably best asked the developers. However: All my programs output everything that is not actual data to stderr. The reason is that I usually print the result on stdout and this should be separate from logging.
    – Fabian
    Commented May 21, 2014 at 20:30

1 Answer 1


Messages to the users go on stderr. What goes to stdout is the result of the openssl command.

By default, unless you use -in or -out, openssl takes data (keys, certificates...) in from stdin and writes data out on stdout (the result like the request pem file).

In a shell you typically use it as:

openssl cmd < in.pem > out.pem

You don't want the messages to the user to end up in out.pem which is why they are issued on stderr.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .