I generated prv.pem with:
(step 1)
openssl genrsa -out prv.pem 2048
Then I generated csr.pem with:
(step 2)
openssl req -new -inform PEM -key prv.pem -out csr.pem
Then finally I'm able to generate crt.pem with:
(step 3)
openssl x509 -req -in csr.pem -signkey prv.pem -out crt.pem
I noticed that repeating step 2 always writes the exact same sequence (deterministically) of output bytes into csr.pem.
I noticed that repeating step 3 writes nondeterministic results into crt.pem.
- Why is step 3 nondeterministic?
- Is there an additional parameter I can provide to
openssl x509 ...that would cause the output to be deterministic?