diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index d6b5d39..ad0a158 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -759,11 +759,11 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
 						die "Failed create CA private key"
 		elif [ "ed" = "$EASYRSA_ALGO" ]; then
 			if [ "ed25519" = "$EASYRSA_CURVE" ]; then
-				"$EASYRSA_OPENSSL" genpkey -algorithm ED25519 -out $out_key_tmp \
+				"$EASYRSA_OPENSSL" genpkey -algorithm ED25519 -out "$out_key_tmp" \
 					$crypto_opts ${EASYRSA_PASSOUT:+-pass "$EASYRSA_PASSOUT"} || \
 						die "Failed create CA private key"
 			elif [ "ed448" = "$EASYRSA_CURVE" ]; then
-				"$EASYRSA_OPENSSL" genpkey -algorithm ED448 -out $out_key_tmp \
+				"$EASYRSA_OPENSSL" genpkey -algorithm ED448 -out "$out_key_tmp" \
 					$crypto_opts ${EASYRSA_PASSOUT:+-pass "$EASYRSA_PASSOUT"} || \
 						die "Failed create CA private key"
 			fi
@@ -779,7 +779,7 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
 
 		#shellcheck disable=SC2086
 		easyrsa_openssl req -utf8 -new -key "$out_key_tmp" \
-		-keyout "$out_key_tmp" -out "$out_file_tmp" $crypto_opts $opts \
+			-keyout "$out_key_tmp" -out "$out_file_tmp" $crypto_opts $opts \
 			${EASYRSA_PASSIN:+-passin "$EASYRSA_PASSIN"} || \
 				die "Failed to build the CA"
 	;;