No OpenSSL randomness retrieved.

[gobbledy-gook]

While trying to setup opensslv3 with oqs-provider, I tried generating certificate using the following command

sudo /opt/oqssa/bin/openssl req -x509 -new -newkey dilithium3 -keyout CA.key -out CA.crt -nodes -subj "/CN=oqstest CA" -days 365 -config /opt/oqssa/ssl/openssl.cnf

and I got the following error:

No OpenSSL randomness retrieved. DRBG available?

However, when I ran /opt/oqssa/bin/openssl rand -hex 10, it executed perfectly fine. I don't understand what is the issue? Any help would be highly appreciated. Thanks!

Note: I using a mac. Setting up locally and not a docker image.

[baentsch]

Most likely your config in "/opt/oqssa/ssl/openssl.cnf" does not have default provider active: From https://github.com/open-quantum-safe/oqs-provider/blob/main/USAGE.md:

Note: Be sure to always activate either the "default" or "fips" provider as these deliver functionality also needed by oqsprovider (e.g., for hashing or high quality random data during key generation).

[gobbledy-gook]

openssl list -providers results in listing both the default and oqs provider. But now I have come to believe it's some issue when trying to use commands from dockerfile (linux-based) and converting to local system shell commands (macOS-based). Thereby it has to do with improper linking of dylib(on Mac) files I suppose. Is there a way I can verify if the correct dylib files have been linked or not ?

(To check the linked dylib files I tried using otools -l <path to openssl> but I failed to understand the output properly.) Help along these lines would be great!

[baentsch]

Is there a way I can verify if the correct dylib files have been linked or not ?

Sorry, I have not much experience with macos. I think @dstebila knows that platform better (or @Martyrshot ?)

[dstebila]

Sorry, I have not much experience with macos. I think @dstebila knows that platform better (or @Martyrshot ?)

Not sure either, sorry.

[Martyrshot]

Can you try running otools -L $OQS_PROVIDER_LOCATION (note the capitalized L)? Might also be worth running it on liboqs.a in case it is being built with openssl

[gobbledy-gook]

Somehow (literally) this issue got resolved, so closing this discussion. Thanks for the inputs!