diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 5d8355d..33edc28 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -937,25 +937,6 @@ easyrsa_openssl() {
 		has_config=1
 	fi
 
-	# Auto-escape hazardous characters:
-	# '&' - Workaround 'sed' behavior
-	# '$' - Workaround 'easyrsa' based limitation
-	# This is required for all SSL libs, otherwise,
-	# there are unacceptable differences in behavior
-	# EASYRSA_FORCE_SAFE_SSL will always over-ride
-	if [ -z "$EASYRSA_FORCE_SAFE_SSL" ] && \
-		[ "$working_safe_ssl_conf" ]
-	then
-		: # ok - This has been done before
-		verbose "\
-easyrsa_openssl: escape_hazard SKIPPED"
-	else
-		escape_hazard || \
-			die "easyrsa_openssl - escape_hazard failed"
-		verbose "\
-easyrsa_openssl: escape_hazard COMPLETED"
-	fi
-
 	# Make LibreSSL safe config file from OpenSSL config file
 	# $require_safe_ssl_conf is ALWAYS set by verify_ssl_lib()
 	# Can be over-ruled for OpenSSL by option --no-safe-ssl
@@ -970,10 +951,23 @@ easyrsa_openssl: escape_hazard COMPLETED"
 			[ "$working_safe_ssl_conf" ]
 		then
 			# ok - This has been done before
+			# Set SAFE SSL conf to working SAFE SSL conf
 			easyrsa_safe_ssl_conf="$working_safe_ssl_conf"
 			verbose "\
+easyrsa_openssl: escape_hazard SKIPPED"
+			verbose "\
 easyrsa_openssl: easyrsa_rewrite_ssl_config SKIPPED"
 		else
+			# Auto-escape hazardous characters:
+			# '&' - Workaround 'sed' behavior
+			# '$' - Workaround 'easyrsa' based limitation
+			# This is required for all SSL libs, otherwise,
+			# there are unacceptable differences in behavior
+			escape_hazard || \
+				die "easyrsa_openssl - escape_hazard failed"
+			verbose "\
+easyrsa_openssl: escape_hazard COMPLETED"
+
 			# Assign easyrsa_safe_ssl_conf temp-file
 			easyrsa_safe_ssl_conf=""
 			easyrsa_mktemp easyrsa_safe_ssl_conf || die "\