nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for dh.pem before overwriting

Browse Source 
gen-dh would overwrite dh.pem without warning

In batch mode, easyrsa now exits 1 if dh.pem exists.

In interactive move, the user is prompted if dh.pem exists.

Fixes #373

Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This commit is contained in:
Eric F Crist 2020-04-14 19:36:14 -05:00
parent 3e93f925d3
commit 0fdd390c11
No known key found for this signature in database
GPG Key ID: 72964219390D0D0E
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
easyrsa3/easyrsa
View File

@ -711,6 +711,18 @@ gen_dh() {
verify_pki_init
out_file="$EASYRSA_PKI/dh.pem"
# check to see if we already have a dh parameters file
if [ -e "$EASYRSA_PKI/dh.pem" ]; then
if [ "$EASYRSA_BATCH" = "1" ]; then
# if batch is enabled, die
die "file $EASYRSA_PKI/dh.pem already exists!"
else
# warn the user, give them a chance to force overwrite
confirm "Overwrite? " "yes" "*** File $EASYRSA_PKI/dh.pem already exists! ***"
fi
fi
"$EASYRSA_OPENSSL" dhparam -out "$out_file" "$EASYRSA_KEY_SIZE" || \
die "Failed to build DH params"
notice "\