openssl x509 gives nondeterministic results

Viewed 17

I generated prv.pem with:

(step 1)
openssl genrsa -out prv.pem 2048

Then I generated csr.pem with:

(step 2)
openssl req -new -inform PEM -key prv.pem -out csr.pem

Then finally I'm able to generate crt.pem with:

(step 3)
openssl x509 -req -in csr.pem -signkey prv.pem -out crt.pem

I noticed that repeating step 2 always writes the exact same sequence (deterministically) of output bytes into csr.pem.

I noticed that repeating step 3 writes nondeterministic results into crt.pem.

  • Why is step 3 nondeterministic?
  • Is there an additional parameter I can provide to openssl x509 ... that would cause the output to be deterministic?
0 Answers
Related