diff --git a/ChangeLog b/ChangeLog
index 5c6c3d841..2353b598e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,7 @@ Easy-RSA 3 ChangeLog
 
 3.2.0 (TBD)
 
+   * build-ca: Command 'req', remove SSL option '-keyout' (4e02c8a) (#1123)
    * Remove escape_hazard(), obsolete (ca76697)
    * Remove command and function display_cn(), unused (be8f400) (#1114)
    * Introduce Options to edit Request Subject during command 'sign-req'
diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 361d36651..5ec86a175 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1794,7 +1794,7 @@ build_ca: CA key password created via temp-files"
 
 	# Generate the CA keypair:
 	easyrsa_openssl req -utf8 -new \
-		-key "$out_key_tmp" -keyout "$out_key_tmp" \
+		-key "$out_key_tmp" \
 		-out "$out_file_tmp" \
 		${ssl_batch:+ -batch} \
 		${x509:+ -x509} \