From 6b51c2a85a663ee37b502eb859d36189af872ae6 Mon Sep 17 00:00:00 2001
From: Tomas Mraz <tomas@openssl.org>
Date: Mon, 15 Dec 2025 12:19:30 +0100
Subject: [PATCH] apps/req.c: Always set permissions for private key output

The key output will be always private.

Reported with a proposed fix by Stanislav Fort (Aisle Research).

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29397)
---
 apps/req.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/req.c b/apps/req.c
index 74d44367b37..98c1ce8d169 100644
--- a/apps/req.c
+++ b/apps/req.c
@@ -740,7 +740,7 @@ int req_main(int argc, char **argv)
             else
                 BIO_printf(bio_err, "'%s'\n", keyout);
         }
-        out = bio_open_owner(keyout, outformat, newreq);
+        out = bio_open_owner(keyout, outformat, 1);
         if (out == NULL)
             goto end;
 
-- 
2.47.3