The OpenSSL command-line utility at times complains that it is “unable to write ‘random state'” due to insufficient user permissions.

As a part of our Server Management Services, we help our Customers to fix OpenSSL related errors regularly.

Let us today discuss the possible causes and fixes for this error.

What causes OpenSSL unable to write ‘random state’ error?

While using OpenSSL commands, it at times triggers a message that it is unable to write. A typical error message looks like the one given below:

The possible reasons for this error include:

1. No default filename is known because neither RANDFILE nor HOME is set.
2. Root user owns the .rnd file in the home directory rather than user account.
3. Unable to create file as user do not have permission to create a file at $HOME/.rnd.

Let us now looks at the steps to fix this error.

How to fix  OpenSSL unable to write ‘random state’ error?

The first step to fix this error is to delete the .rnd file and reissue the OpenSSL command. The commands below will help us to perform it.

sudo rm ~/.rnd
openssl genrsa -des3 -out server.key 2048

Further, the error happens when a root user owns the files, we can fix it by changing the ownership to an account username. So, check RANDFILE, HOME, and permissions to write to those places in the filesystem.

sudo chown $USER:$USER ~/.rnd

When no default filename is set, we must tell openssl the file to use for writing random state. This can be done by exporting the $RANDFILE environment variable. The command for this is as follows:

export RANDFILE=/path_to_home_directory/.rnd

Another option is to set environment variable RANDFILE to path where the ‘random state’ file can be written

set RANDFILE=C:\MyDir\.rnd
openssl genrsa -out my-prvkey.pem 1024

[Need any further assistance in fixing OpenSSL errors? – We’re available 24*7]

Conclusion

In short, OpenSSL unable to write ‘random state’ message triggers due to the permission issue of the random file or when the default file is not set. Today, we saw how our Support Engineers fix this error.