Quoting this comment by atoponce from /r/netsec: http://www.reddit.com/r/netsec/comments/2xlruv/ubuntu_cloud_prng_seed/cp1996q http://www.reddit.com/r/netsec/co

Quoting this comment by atoponce from /r/netsec: http://www.reddit.com/r/netsec/comments/2xlruv/ubuntu_cloud_prng_seed/cp1996q http://www.reddit.com/r/netsec/comments/2xlruv/ubuntu_cloud_...: >"Starting with Ubuntu 14.04 LTS, Ubuntu cloud images include the Pollinate client, which will try to seed the PRNG with input from https://entropy.ubuntu.com https://entropy.ubuntu.com for up to 3 seconds on first boot." So, let me get this straight. An Ubuntu cloud image doesn't have enough entropy to create strong crypto keys on first boot (SSH, SSL, etc.). So, it connects over the Internet, via HTTPS, which requires strong crypto keys to make the connection, to gather its entropy. Facepalm. The correct answer to generating enough entropy on boot is to either install haveged(8) as part of the imaging process, or to have the cloud image attach to a HWRNG using something similar to VirtIORNG. Enough entropy needs to be created before making an HTTPS connection, not after.