bio_err is initialised in main, hence there is no need to initialise it

in each application (since there is no longer a non-monolithic mode).

In typical OpenSSL fashion, the code is inconsistent and there are multiple
ways that bio_err was initialised - none of them actually checked to see if
the initialisation actually succeeded. Additionally, it is worth noting
that in at least two cases bio_err was also being used before it would have
been initialised.

ok miod@

46 files changed, 16 insertions, 168 deletions

diff --git a/lib/libssl/src/apps/asn1pars.c b/lib/libssl/src/apps/asn1pars.c
index 1459a5ac386..a8af0aa4e9d 100644
--- a/lib/libssl/src/apps/asn1pars.c
+++ b/lib/libssl/src/apps/asn1pars.c
@@ -102,10 +102,6 @@ asn1parse_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/ca.c b/lib/libssl/src/apps/ca.c
index a66a580ded6..c7715988025 100644
--- a/lib/libssl/src/apps/ca.c
+++ b/lib/libssl/src/apps/ca.c
@@ -329,9 +329,6 @@ ca_main(int argc, char **argv)
 
 	preserve = 0;
 	msie_hack = 0;
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
 
 	argc--;
 	argv++;
diff --git a/lib/libssl/src/apps/ciphers.c b/lib/libssl/src/apps/ciphers.c
index 3e2fb4c4467..70d9a894096 100644
--- a/lib/libssl/src/apps/ciphers.c
+++ b/lib/libssl/src/apps/ciphers.c
@@ -95,8 +95,6 @@ ciphers_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
 	STDout = BIO_new_fp(stdout, BIO_NOCLOSE);
 	if (!load_config(bio_err, NULL))
 		goto end;
diff --git a/lib/libssl/src/apps/cms.c b/lib/libssl/src/apps/cms.c
index 03459c64a20..fa1bd9a3a2e 100644
--- a/lib/libssl/src/apps/cms.c
+++ b/lib/libssl/src/apps/cms.c
@@ -146,10 +146,6 @@ cms_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL) {
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-	}
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/crl.c b/lib/libssl/src/apps/crl.c
index fb963274fff..50ac0e118d5 100644
--- a/lib/libssl/src/apps/crl.c
+++ b/lib/libssl/src/apps/crl.c
@@ -125,10 +125,6 @@ crl_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/crl2p7.c b/lib/libssl/src/apps/crl2p7.c
index 4d3ff4d4593..f972a394d69 100644
--- a/lib/libssl/src/apps/crl2p7.c
+++ b/lib/libssl/src/apps/crl2p7.c
@@ -98,10 +98,6 @@ crl2pkcs7_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	infile = NULL;
 	outfile = NULL;
 	informat = FORMAT_PEM;
diff --git a/lib/libssl/src/apps/dgst.c b/lib/libssl/src/apps/dgst.c
index 523f5ccc6ba..f2c228cc3d3 100644
--- a/lib/libssl/src/apps/dgst.c
+++ b/lib/libssl/src/apps/dgst.c
@@ -135,9 +135,6 @@ dgst_main(int argc, char **argv)
 		BIO_printf(bio_err, "out of memory\n");
 		goto end;
 	}
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
 
 	if (!load_config(bio_err, NULL))
 		goto end;
diff --git a/lib/libssl/src/apps/dh.c b/lib/libssl/src/apps/dh.c
index a02bae93c58..7e5e1427604 100644
--- a/lib/libssl/src/apps/dh.c
+++ b/lib/libssl/src/apps/dh.c
@@ -98,10 +98,6 @@ dh_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/dhparam.c b/lib/libssl/src/apps/dhparam.c
index b09f6418e38..0cb99c53409 100644
--- a/lib/libssl/src/apps/dhparam.c
+++ b/lib/libssl/src/apps/dhparam.c
@@ -164,10 +164,6 @@ dhparam_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/dsa.c b/lib/libssl/src/apps/dsa.c
index f9be2392d8e..81040193c73 100644
--- a/lib/libssl/src/apps/dsa.c
+++ b/lib/libssl/src/apps/dsa.c
@@ -115,10 +115,6 @@ dsa_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/dsaparam.c b/lib/libssl/src/apps/dsaparam.c
index 0db04ed6f41..6488c4b69d2 100644
--- a/lib/libssl/src/apps/dsaparam.c
+++ b/lib/libssl/src/apps/dsaparam.c
@@ -126,10 +126,6 @@ dsaparam_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/ec.c b/lib/libssl/src/apps/ec.c
index 0fcf81a79e2..3f4a1d00455 100644
--- a/lib/libssl/src/apps/ec.c
+++ b/lib/libssl/src/apps/ec.c
@@ -102,10 +102,6 @@ ec_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/ecparam.c b/lib/libssl/src/apps/ecparam.c
index 49aeab8355e..84ecba72f54 100644
--- a/lib/libssl/src/apps/ecparam.c
+++ b/lib/libssl/src/apps/ecparam.c
@@ -136,10 +136,6 @@ ecparam_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/enc.c b/lib/libssl/src/apps/enc.c
index cda196a782b..0ac6a43f6a9 100644
--- a/lib/libssl/src/apps/enc.c
+++ b/lib/libssl/src/apps/enc.c
@@ -131,10 +131,6 @@ enc_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/engine.c b/lib/libssl/src/apps/engine.c
index 6134de94cb5..7b11ea57d9c 100644
--- a/lib/libssl/src/apps/engine.c
+++ b/lib/libssl/src/apps/engine.c
@@ -339,11 +339,9 @@ engine_main(int argc, char **argv)
 	signal(SIGPIPE, SIG_IGN);
 	SSL_load_error_strings();
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
+
 	bio_out = BIO_new_fp(stdout, BIO_NOCLOSE);
 
 	argc--;
diff --git a/lib/libssl/src/apps/errstr.c b/lib/libssl/src/apps/errstr.c
index 9766a54b089..4605f098ab5 100644
--- a/lib/libssl/src/apps/errstr.c
+++ b/lib/libssl/src/apps/errstr.c
@@ -77,10 +77,6 @@ errstr_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	SSL_load_error_strings();
 
 	if ((argc > 1) && (strcmp(argv[1], "-stats") == 0)) {
diff --git a/lib/libssl/src/apps/gendh.c b/lib/libssl/src/apps/gendh.c
index 07e8b333904..4dd5c02a9eb 100644
--- a/lib/libssl/src/apps/gendh.c
+++ b/lib/libssl/src/apps/gendh.c
@@ -101,9 +101,6 @@ gendh_main(int argc, char **argv)
 	signal(SIGPIPE, SIG_IGN);
 
 	BN_GENCB_set(&cb, dh_cb, bio_err);
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
 
 	if (!load_config(bio_err, NULL))
 		goto end;
diff --git a/lib/libssl/src/apps/gendsa.c b/lib/libssl/src/apps/gendsa.c
index 07eb7563720..df0993edb4c 100644
--- a/lib/libssl/src/apps/gendsa.c
+++ b/lib/libssl/src/apps/gendsa.c
@@ -90,10 +90,6 @@ gendsa_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/genpkey.c b/lib/libssl/src/apps/genpkey.c
index 8d2f6d6ae81..1b3bc57e7dd 100644
--- a/lib/libssl/src/apps/genpkey.c
+++ b/lib/libssl/src/apps/genpkey.c
@@ -91,9 +91,6 @@ genpkey_main(int argc, char **argv)
 
 	int do_param = 0;
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/genrsa.c b/lib/libssl/src/apps/genrsa.c
index 643e20da2f3..7e5dd2b2397 100644
--- a/lib/libssl/src/apps/genrsa.c
+++ b/lib/libssl/src/apps/genrsa.c
@@ -112,12 +112,9 @@ genrsa_main(int argc, char **argv)
 	signal(SIGPIPE, SIG_IGN);
 	BN_GENCB_set(&cb, genrsa_cb, bio_err);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto err;
+
 	if ((out = BIO_new(BIO_s_file())) == NULL) {
 		BIO_printf(bio_err, "unable to create BIO for output\n");
 		goto err;
diff --git a/lib/libssl/src/apps/nseq.c b/lib/libssl/src/apps/nseq.c
index 120792edbce..0a1512afcfb 100644
--- a/lib/libssl/src/apps/nseq.c
+++ b/lib/libssl/src/apps/nseq.c
@@ -75,9 +75,9 @@ nseq_main(int argc, char **argv)
 	NETSCAPE_CERT_SEQUENCE *seq = NULL;
 	int i, ret = 1;
 	int badarg = 0;
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
+
 	ERR_load_crypto_strings();
+
 	args = argv + 1;
 	while (!badarg && *args && *args[0] == '-') {
 		if (!strcmp(*args, "-toseq"))
diff --git a/lib/libssl/src/apps/ocsp.c b/lib/libssl/src/apps/ocsp.c
index 461f21d6eb8..95778210db1 100644
--- a/lib/libssl/src/apps/ocsp.c
+++ b/lib/libssl/src/apps/ocsp.c
@@ -137,7 +137,6 @@ ocsp_main(int argc, char **argv)
 	int ignore_err = 0;
 	STACK_OF(OPENSSL_STRING) * reqnames = NULL;
 	STACK_OF(OCSP_CERTID) * ids = NULL;
-
 	X509 *rca_cert = NULL;
 	char *ridx_filename = NULL;
 	char *rca_filename = NULL;
@@ -145,13 +144,12 @@ ocsp_main(int argc, char **argv)
 	int nmin = 0, ndays = -1;
 	const EVP_MD *cert_id_md = NULL;
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
+
 	SSL_load_error_strings();
 	OpenSSL_add_ssl_algorithms();
+
 	args = argv + 1;
 	reqnames = sk_OPENSSL_STRING_new_null();
 	ids = sk_OCSP_CERTID_new_null();
diff --git a/lib/libssl/src/apps/openssl.c b/lib/libssl/src/apps/openssl.c
index 1dbc7f464fe..2250701f68a 100644
--- a/lib/libssl/src/apps/openssl.c
+++ b/lib/libssl/src/apps/openssl.c
@@ -109,6 +109,7 @@
  *
  */
 
+#include <err.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -252,9 +253,9 @@ main(int argc, char **argv)
 	arg.data = NULL;
 	arg.count = 0;
 
+	bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
 	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
+		errx(1, "failed to initialise bio_err");
 
 	CRYPTO_set_locking_callback(lock_dbg_cb);
 
diff --git a/lib/libssl/src/apps/passwd.c b/lib/libssl/src/apps/passwd.c
index 105625b4ed8..30a38aafb86 100644
--- a/lib/libssl/src/apps/passwd.c
+++ b/lib/libssl/src/apps/passwd.c
@@ -75,12 +75,9 @@ passwd_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto err;
+
 	out = BIO_new(BIO_s_file());
 	if (out == NULL)
 		goto err;
diff --git a/lib/libssl/src/apps/pkcs12.c b/lib/libssl/src/apps/pkcs12.c
index 8ea749616d6..f23d902eb3c 100644
--- a/lib/libssl/src/apps/pkcs12.c
+++ b/lib/libssl/src/apps/pkcs12.c
@@ -135,15 +135,12 @@ pkcs12_main(int argc, char **argv)
 	cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
 
 	enc = EVP_des_ede3_cbc();
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
 
 	if (!load_config(bio_err, NULL))
 		goto end;
 
 	args = argv + 1;
 
-
 	while (*args) {
 		if (*args[0] == '-') {
 			if (!strcmp(*args, "-nokeys"))
diff --git a/lib/libssl/src/apps/pkcs7.c b/lib/libssl/src/apps/pkcs7.c
index c2093ddd121..8540a3f6c2f 100644
--- a/lib/libssl/src/apps/pkcs7.c
+++ b/lib/libssl/src/apps/pkcs7.c
@@ -94,10 +94,6 @@ pkcs7_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/pkcs8.c b/lib/libssl/src/apps/pkcs8.c
index eb36946d482..ee6a48fc140 100644
--- a/lib/libssl/src/apps/pkcs8.c
+++ b/lib/libssl/src/apps/pkcs8.c
@@ -90,9 +90,6 @@ pkcs8_main(int argc, char **argv)
 	char *engine = NULL;
 #endif
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/pkey.c b/lib/libssl/src/apps/pkey.c
index bd439cbf791..627278fabc5 100644
--- a/lib/libssl/src/apps/pkey.c
+++ b/lib/libssl/src/apps/pkey.c
@@ -83,9 +83,6 @@ pkey_main(int argc, char **argv)
 #endif
 	int ret = 1;
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/pkeyparam.c b/lib/libssl/src/apps/pkeyparam.c
index b653dee7940..caeaf193df6 100644
--- a/lib/libssl/src/apps/pkeyparam.c
+++ b/lib/libssl/src/apps/pkeyparam.c
@@ -78,9 +78,6 @@ pkeyparam_main(int argc, char **argv)
 #endif
 	int ret = 1;
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/pkeyutl.c b/lib/libssl/src/apps/pkeyutl.c
index 64ccd142ced..c112c773b91 100644
--- a/lib/libssl/src/apps/pkeyutl.c
+++ b/lib/libssl/src/apps/pkeyutl.c
@@ -106,11 +106,9 @@ pkeyutl_main(int argc, char **argv)
 	argc--;
 	argv++;
 
-	if (!bio_err)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
+
 	ERR_load_crypto_strings();
 	OpenSSL_add_all_algorithms();
 
diff --git a/lib/libssl/src/apps/prime.c b/lib/libssl/src/apps/prime.c
index 5d15f5fbd7c..c6f562a7e3a 100644
--- a/lib/libssl/src/apps/prime.c
+++ b/lib/libssl/src/apps/prime.c
@@ -69,10 +69,6 @@ prime_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	--argc;
 	++argv;
 	while (argc >= 1 && **argv == '-') {
diff --git a/lib/libssl/src/apps/rand.c b/lib/libssl/src/apps/rand.c
index 458d5ac7b88..355a42e184a 100644
--- a/lib/libssl/src/apps/rand.c
+++ b/lib/libssl/src/apps/rand.c
@@ -90,10 +90,6 @@ rand_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto err;
 
diff --git a/lib/libssl/src/apps/req.c b/lib/libssl/src/apps/req.c
index 5cfbc442ea8..26a3e1196cc 100644
--- a/lib/libssl/src/apps/req.c
+++ b/lib/libssl/src/apps/req.c
@@ -190,10 +190,6 @@ req_main(int argc, char **argv)
 #endif
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	infile = NULL;
 	outfile = NULL;
 	informat = FORMAT_PEM;
diff --git a/lib/libssl/src/apps/rsa.c b/lib/libssl/src/apps/rsa.c
index 286183582af..3e0b2ebfac2 100644
--- a/lib/libssl/src/apps/rsa.c
+++ b/lib/libssl/src/apps/rsa.c
@@ -118,10 +118,6 @@ rsa_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/rsautl.c b/lib/libssl/src/apps/rsautl.c
index 9c5b96fa2a9..04992ae609b 100644
--- a/lib/libssl/src/apps/rsautl.c
+++ b/lib/libssl/src/apps/rsautl.c
@@ -107,11 +107,9 @@ rsautl_main(int argc, char **argv)
 	argc--;
 	argv++;
 
-	if (!bio_err)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
+
 	ERR_load_crypto_strings();
 	OpenSSL_add_all_algorithms();
 	pad = RSA_PKCS1_PADDING;
diff --git a/lib/libssl/src/apps/s_client.c b/lib/libssl/src/apps/s_client.c
index b90a096b406..7549c980e09 100644
--- a/lib/libssl/src/apps/s_client.c
+++ b/lib/libssl/src/apps/s_client.c
@@ -475,9 +475,6 @@ s_client_main(int argc, char **argv)
 	c_msg = 0;
 	c_showcerts = 0;
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/s_server.c b/lib/libssl/src/apps/s_server.c
index 6cb43ed45df..67886bbb586 100644
--- a/lib/libssl/src/apps/s_server.c
+++ b/lib/libssl/src/apps/s_server.c
@@ -725,9 +725,6 @@ s_server_main(int argc, char *argv[])
 	signal(SIGPIPE, SIG_IGN);
 	s_server_init();
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/s_time.c b/lib/libssl/src/apps/s_time.c
index 8ce2c671a2e..4cf62ffea62 100644
--- a/lib/libssl/src/apps/s_time.c
+++ b/lib/libssl/src/apps/s_time.c
@@ -318,9 +318,6 @@ s_time_main(int argc, char **argv)
 	signal(SIGPIPE, SIG_IGN);
 	s_time_init();
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	s_time_meth = SSLv23_client_method();
 
 	/* parse the command line arguments */
diff --git a/lib/libssl/src/apps/sess_id.c b/lib/libssl/src/apps/sess_id.c
index 95bc71fe70b..49766fdb650 100644
--- a/lib/libssl/src/apps/sess_id.c
+++ b/lib/libssl/src/apps/sess_id.c
@@ -99,10 +99,6 @@ sess_id_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	informat = FORMAT_PEM;
 	outformat = FORMAT_PEM;
 
diff --git a/lib/libssl/src/apps/smime.c b/lib/libssl/src/apps/smime.c
index 4fdf170df77..f7d56b30055 100644
--- a/lib/libssl/src/apps/smime.c
+++ b/lib/libssl/src/apps/smime.c
@@ -122,10 +122,6 @@ smime_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL) {
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-	}
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/speed.c b/lib/libssl/src/apps/speed.c
index 76ab66c547a..f96e9019171 100644
--- a/lib/libssl/src/apps/speed.c
+++ b/lib/libssl/src/apps/speed.c
@@ -537,11 +537,6 @@ speed_main(int argc, char **argv)
 	}
 #endif
 
-
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/spkac.c b/lib/libssl/src/apps/spkac.c
index 7de9450b875..8fa21d98260 100644
--- a/lib/libssl/src/apps/spkac.c
+++ b/lib/libssl/src/apps/spkac.c
@@ -98,9 +98,6 @@ spkac_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (!bio_err)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/ts.c b/lib/libssl/src/apps/ts.c
index d154616a858..c2d333cf7ec 100644
--- a/lib/libssl/src/apps/ts.c
+++ b/lib/libssl/src/apps/ts.c
@@ -153,15 +153,11 @@ ts_main(int argc, char **argv)
 	int token_in = 0;
 	/* Output is ContentInfo instead of TimeStampResp. */
 	int token_out = 0;
-	int free_bio_err = 0;
 
 	ERR_load_crypto_strings();
+
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL && (bio_err = BIO_new(BIO_s_file())) != NULL) {
-		free_bio_err = 1;
-		BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-	}
 	if (!load_config(bio_err, NULL))
 		goto cleanup;
 
@@ -338,15 +334,13 @@ usage:
 	    "-in response.tsr [-token_in] "
 	    "-CApath ca_path -CAfile ca_file.pem "
 	    "-untrusted cert_file.pem\n");
+
 cleanup:
 	/* Clean up. */
 	NCONF_free(conf);
 	free(password);
 	OBJ_cleanup();
-	if (free_bio_err) {
-		BIO_free_all(bio_err);
-		bio_err = NULL;
-	}
+
 	return (ret);
 }
 
diff --git a/lib/libssl/src/apps/verify.c b/lib/libssl/src/apps/verify.c
index e2d34bccb3e..b73956bc578 100644
--- a/lib/libssl/src/apps/verify.c
+++ b/lib/libssl/src/apps/verify.c
@@ -99,10 +99,6 @@ verify_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
 
diff --git a/lib/libssl/src/apps/version.c b/lib/libssl/src/apps/version.c
index 927704b65e0..e7c58b5ae0b 100644
--- a/lib/libssl/src/apps/version.c
+++ b/lib/libssl/src/apps/version.c
@@ -141,10 +141,6 @@ version_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		if ((bio_err = BIO_new(BIO_s_file())) != NULL)
-			BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
-
 	if (argc == 1)
 		version = 1;
 	for (i = 1; i < argc; i++) {
diff --git a/lib/libssl/src/apps/x509.c b/lib/libssl/src/apps/x509.c
index a7c451948b1..389b752151b 100644
--- a/lib/libssl/src/apps/x509.c
+++ b/lib/libssl/src/apps/x509.c
@@ -210,11 +210,9 @@ x509_main(int argc, char **argv)
 
 	signal(SIGPIPE, SIG_IGN);
 
-	if (bio_err == NULL)
-		bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
-
 	if (!load_config(bio_err, NULL))
 		goto end;
+
 	STDout = BIO_new_fp(stdout, BIO_NOCLOSE);
 
 	informat = FORMAT_PEM;