Skip to content

Can't load random.rnd into RNG with OpenSSL 1.1.1b 26 Feb 2019 #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Kiesel38 opened this issue Mar 28, 2019 · 10 comments · Fixed by #8
Closed

Can't load random.rnd into RNG with OpenSSL 1.1.1b 26 Feb 2019 #7

Kiesel38 opened this issue Mar 28, 2019 · 10 comments · Fixed by #8

Comments

@Kiesel38
Copy link

Hello,

after i update OpenSSL to version 1.1.1b the certificates can't be created anymore.
I got this error:

Can't load random.rnd into RNG 1996141840:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=random.rnd

The random.rnd files are not created during the certificate creation.
I was able to fix this manually by creating the random.rnd files by myself and then create the certificates after the node installation. Unfortunately the files are deleted when i installed the node again.

Version 1.0.x. works but the support ends in September 2019.

@Kiesel38
Copy link
Author

I found a solution for the problem.

OpenSSL 1.1.1b need the command -writerand instead of -rand for the random number generation if no .rnd file is present. I changed this in the following files:

node-opcua-pki/dist/lib/pki/certificate_authority.js
node-opcua-pki/dist/lib/pki/toolbox.js
node-opcua-pki/lib/pki/certificate_authority.ts
node-opcua-pki/lib/pki/toolbox.ts

Now the certificates can be created.

@harimau99
Copy link

harimau99 commented Sep 20, 2019

I found a solution for the problem.

OpenSSL 1.1.1b need the command -writerand instead of -rand for the random number generation if no .rnd file is present. I changed this in the following files:

node-opcua-pki/dist/lib/pki/certificate_authority.js
node-opcua-pki/dist/lib/pki/toolbox.js
node-opcua-pki/lib/pki/certificate_authority.ts
node-opcua-pki/lib/pki/toolbox.ts

Now the certificates can be created.

Hi @Kiesel38.
how do you make it writable ?
openssl rand <the listed file you mention ?>

@bathindahelper
Copy link

Can somebody give me the full command pls?
i was using this command (by finding the exact command from some 2 year old video): sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx.key -out /etc/ssl/certs/nginx.crt

And I'm getting this error: "Can't load /root/.rnd into RNG
140121868997056:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd"

I'm using latest openssh (just downloaded) on Ubuntu 18.04.x (upgraded)

@Ejdamm
Copy link

Ejdamm commented Jan 14, 2020

@bathindahelper You can manually create the file with openssl rand -out <randFile> -hex 256. In your case sudo openssl rand -out /root/.rnd -hex 256.

@ppapias1987
Copy link

@Ejdamm : Hej.. I am dealing with a relevant problem when i give this command:
openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

the terminal returns back the following:

Can't load /home/ubuntu/.rnd into RNG
140115398300096:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/home/ubuntu/.rnd

@Ejdamm
Copy link

Ejdamm commented Mar 30, 2020

@ppapias1987

Have you tried creating the file that is missing, eg /home/ubuntu/.rnd?
openssl rand -out /home/ubuntu/.rnd -hex 256
Also, your key and cert is named the same. Switch to -keyout mykey.pem

@jmasaki24
Copy link

I had the same problem, and then created the .rnd myself as you said. I'm trying to create a self-signed certificate, and this time, when I ran openssl req -x509 -newkey rsa:2048 -keyout ca_key.pem -out ca_cert.pem -days 365 I no longer got an error, but it hangs on "Generating a RSA private key". This is a bit of a different problem, but I was wondering if you could help me out?
This StackExchange answer said it lacks entropy.
Would that mean I need a bigger .rnd file? I'm terribly confused, and new to this stuff.

@ppapias1987
Copy link

@Ejdamm

Yes! I tried it before without success, however i managed to figure it out later. Sorry for the delay to respond.

@Lovor01
Copy link

Lovor01 commented May 12, 2020

I had the same problem, and then created the .rnd myself as you said. I'm trying to create a self-signed certificate, and this time, when I ran openssl req -x509 -newkey rsa:2048 -keyout ca_key.pem -out ca_cert.pem -days 365 I no longer got an error, but it hangs on "Generating a RSA private key". This is a bit of a different problem, but I was wondering if you could help me out?
This StackExchange answer said it lacks entropy.
Would that mean I need a bigger .rnd file? I'm terribly confused, and new to this stuff.

If you are working on windows, you should set environment variable to path of .rnd file, i.e.
set RANDFILE=.rnd

@MohammadAliAfsahi
Copy link

MohammadAliAfsahi commented May 17, 2020

@bathindahelper You can manually create the file with openssl rand -out <randFile> -hex 256. In your case sudo openssl rand -out /root/.rnd -hex 256.

Thanks....
This solution was helpful to solve the problem.
I wanted to create self signed certificate using following command:
openssl req -key private.pem -new -x509 -days 365 -subj "/C=IR/" -out SelfSigned.crt

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

8 participants