openssl req -new -newkey does not output generated key to stdout

[RuStrannik]

> openssl version
OpenSSL 3.0.9 30 May 2023 (Library: OpenSSL 3.0.9 30 May 2023)

Documentation states that If a new key is generated and no filename is specified the key is written to standard output. however, this is not happening.

Here is the command I'm running:

> openssl req -x509 -new -noenc -newkey ec -pkeyopt ec_paramgen_curve:P-256 -subj "/C=US/ST=CA/L=San Francisco/O=Example LLC/OU=IT Dept/CN=exmaple.org/emailAddress=it@exmaple.org" -addext "subjectAltName=DNS:www.exmaple.org,DNS:mail.exmaple.org"

And this is what I get:

-----
-----BEGIN CERTIFICATE-----
MIICozCCAkqgAwIBAgIUbD19hJmlimRbbq0jgAh7AxXfLPkwCgYIKoZIzj0EAwIw
gY8xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5j
aXNjbzEUMBIGA1UECgwLRXhhbXBsZSBMTEMxEDAOBgNVBAsMB0lUIERlcHQxFDAS
BgNVBAMMC2V4bWFwbGUub3JnMR0wGwYJKoZIhvcNAQkBFg5pdEBleG1hcGxlLm9y
ZzAeFw0yMzEwMTEyMDA5NTdaFw0yMzExMTAyMDA5NTdaMIGPMQswCQYDVQQGEwJV
UzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xFDASBgNVBAoM
C0V4YW1wbGUgTExDMRAwDgYDVQQLDAdJVCBEZXB0MRQwEgYDVQQDDAtleG1hcGxl
Lm9yZzEdMBsGCSqGSIb3DQEJARYOaXRAZXhtYXBsZS5vcmcwWTATBgcqhkjOPQIB
BggqhkjOPQMBBwNCAAR73AKaf4KAdD2tJCfH3pG8O7x5Ku/aXZHHzl3yYIqFOE1a
XLiV6TpknJ66uzJKT8OBjoQ6W9VQ+Y9eEZSBZjgxo4GBMH8wHQYDVR0OBBYEFJDi
1MIls2fHxmGhHG+Er5VV7quRMB8GA1UdIwQYMBaAFJDi1MIls2fHxmGhHG+Er5VV
7quRMA8GA1UdEwEB/wQFMAMBAf8wLAYDVR0RBCUwI4IPd3d3LmV4bWFwbGUub3Jn
ghBtYWlsLmV4bWFwbGUub3JnMAoGCCqGSM49BAMCA0cAMEQCIAalFuloYEpvvaNK
F/c4hGphHGY1gaSDPLNz4cHIWQb+AiBITJ1WhfZ4jUHl63O10jsGI1NTVTAqr38C
Pp3HwQx2HA==
-----END CERTIFICATE-----

As you can see, there is neither -keyout nor key config file specified, nevertheless, private key gets written into privkey.pem in the current directory anyway. So far looks like it's either the documentation is misleading or there is a bug with ghost value of default_keyfile.

I would expect something like that on stdout:

-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgld4FLaQSLwKry4q+
ZipFcg+QBk52N/ACjWRZvEpld6ChRANCAAR73AKaf4KAdD2tJCfH3pG8O7x5Ku/a
XZHHzl3yYIqFOE1aXLiV6TpknJ66uzJKT8OBjoQ6W9VQ+Y9eEZSBZjgx
-----END PRIVATE KEY-----

-----BEGIN CERTIFICATE-----
MIICozCCAkqgAwIBAgIUbD19hJmlimRbbq0jgAh7AxXfLPkwCgYIKoZIzj0EAwIw
gY8xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5j
aXNjbzEUMBIGA1UECgwLRXhhbXBsZSBMTEMxEDAOBgNVBAsMB0lUIERlcHQxFDAS
BgNVBAMMC2V4bWFwbGUub3JnMR0wGwYJKoZIhvcNAQkBFg5pdEBleG1hcGxlLm9y
ZzAeFw0yMzEwMTEyMDA5NTdaFw0yMzExMTAyMDA5NTdaMIGPMQswCQYDVQQGEwJV
UzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xFDASBgNVBAoM
C0V4YW1wbGUgTExDMRAwDgYDVQQLDAdJVCBEZXB0MRQwEgYDVQQDDAtleG1hcGxl
Lm9yZzEdMBsGCSqGSIb3DQEJARYOaXRAZXhtYXBsZS5vcmcwWTATBgcqhkjOPQIB
BggqhkjOPQMBBwNCAAR73AKaf4KAdD2tJCfH3pG8O7x5Ku/aXZHHzl3yYIqFOE1a
XLiV6TpknJ66uzJKT8OBjoQ6W9VQ+Y9eEZSBZjgxo4GBMH8wHQYDVR0OBBYEFJDi
1MIls2fHxmGhHG+Er5VV7quRMB8GA1UdIwQYMBaAFJDi1MIls2fHxmGhHG+Er5VV
7quRMA8GA1UdEwEB/wQFMAMBAf8wLAYDVR0RBCUwI4IPd3d3LmV4bWFwbGUub3Jn
ghBtYWlsLmV4bWFwbGUub3JnMAoGCCqGSM49BAMCA0cAMEQCIAalFuloYEpvvaNK
F/c4hGphHGY1gaSDPLNz4cHIWQb+AiBITJ1WhfZ4jUHl63O10jsGI1NTVTAqr38C
Pp3HwQx2HA==
-----END CERTIFICATE-----

UPD: just discovered that specifying a dash instead of filename (-keyout -) actually does the trick, however, that was just blind guess, so I think it would still be a good idea to mention that in the documentation.

[t8m]

You need to look at the default_keyfile configuration value in the [req] section of your openssl.cnf file. If it is unchanged from what we ship by default it is set to privkey.pem which means there will probably be a privkey.pem file created with the private key.

The documentation says that the default_keyfile must not be set for the private key output to go to stdout.