From f32df2f932dd7d2880f3071ee6b76509eb8c50a6 Mon Sep 17 00:00:00 2001
From: Richard Bonhomme <25598447+TinCanTech@users.noreply.github.com>
Date: Sun, 16 Dec 2018 18:16:48 +0000
Subject: [PATCH 1/3] Fix password echo

---
 easyrsa3/easyrsa | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index dfd123a..5421458 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -298,7 +298,7 @@ clean_temp() {
 prog_exit() {
 	ESTAT=0
 	[ ! -z "$1" ] && ESTAT=$1
-	(set -o echo 2>/dev/null) || stty echo
+	(stty echo 2>/dev/null) || set -o echo
 	echo "" # just to get a clean line
 	exit "$ESTAT"
 } # => prog_exit()
@@ -463,9 +463,9 @@ Your newly created PKI dir is: $EASYRSA_PKI
 
 hide_read_pass()
 {
-	(set +o echo 2>/dev/null) || stty -echo
+	(stty -echo 2>/dev/null) || set +o echo
 	read -r "$@"
-	(set -o echo 2>/dev/null) || stty echo
+	(stty echo 2>/dev/null) || set -o echo
 } # => hide_read_pass()
 
 # build-ca backend:

From fb6fd5465a9156fc731e0c818ac512406d4f9320 Mon Sep 17 00:00:00 2001
From: Richard Bonhomme <25598447+TinCanTech@users.noreply.github.com>
Date: Tue, 1 Jan 2019 18:07:17 +0000
Subject: [PATCH 2/3] Use EASYRSA specific temp file for output to set_pass

Signed-off-by: Richard Bonhomme <25598447+TinCanTech@users.noreply.github.com>
---
 easyrsa3/easyrsa | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 5421458..2783cc2 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1038,10 +1038,15 @@ $file"
 If the key is currently encrypted you must supply the decryption passphrase.
 ${crypto:+You will then enter a new PEM passphrase for this key.$NL}"
 
-	"$EASYRSA_OPENSSL" "$key_type" -in "$file" -out "$file" $crypto || die "\
+	EASYRSA_TEMP_FILE_2="$file.temp"
+
+	"$EASYRSA_OPENSSL" "$key_type" -in "$file" -out "$EASYRSA_TEMP_FILE_2" $crypto || die "\
 Failed to change the private key passphrase. See above for possible openssl
 error messages."
 
+	mv "$EASYRSA_TEMP_FILE_2" "$file" || die "\
+Failed to change the private key passphrase. See above for error messages."
+
 	notice "Key passphrase successfully changed"
 	
 } # => set_pass()

From 54eb9dc8e627ab7ea1b910122b1d2d4c66d64684 Mon Sep 17 00:00:00 2001
From: Richard Bonhomme <25598447+TinCanTech@users.noreply.github.com>
Date: Fri, 4 Jan 2019 00:43:08 +0000
Subject: [PATCH 3/3] Move verifying the SSL lib to verify_ssl_lib() and only
 call after verify_pki_init()

Signed-off-by: Richard Bonhomme <25598447+TinCanTech@users.noreply.github.com>
---
 easyrsa3/easyrsa | 49 ++++++++++++++++++++++++++----------------------
 1 file changed, 27 insertions(+), 22 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 2783cc2..ef601a1 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -330,28 +330,6 @@ vars_source_check() {
 	# Check for defined EASYRSA_PKI
 	[ -n "$EASYRSA_PKI" ] || die "\
 EASYRSA_PKI env-var undefined"
-
-	# make safessl-easyrsa.cnf
-	make_ssl_config
-
-	# Verify EASYRSA_OPENSSL command gives expected output
-	if [ -z "$EASYRSA_SSL_OK" ]; then
-		val="$("$EASYRSA_OPENSSL" version)"
-		case "${val%% *}" in
-			OpenSSL|LibreSSL)
-				notice "\
-Using SSL: $EASYRSA_OPENSSL $("$EASYRSA_OPENSSL" version)" ;;
-			*) die "\
-Missing or invalid OpenSSL
-Expected to find openssl command at: $EASYRSA_OPENSSL" ;;
-		esac
-	fi
-	EASYRSA_SSL_OK=1
-
-	# Verify EASYRSA_SSL_CONF file exists
-	[ -f "$EASYRSA_SSL_CONF" ] || die "\
-The OpenSSL config file cannot be found.
-Expected location: $EASYRSA_SSL_CONF"
 } # => vars_source_check()
 
 # Verify supplied curve exists and generate curve file if needed
@@ -378,6 +356,30 @@ $out"
 	return 0
 }
 
+verify_ssl_lib () {
+	# make safessl-easyrsa.cnf
+	make_ssl_config
+
+	# Verify EASYRSA_OPENSSL command gives expected output
+	if [ -z "$EASYRSA_SSL_OK" ]; then
+		val="$("$EASYRSA_OPENSSL" version)"
+		case "${val%% *}" in
+			OpenSSL|LibreSSL)
+				notice "\
+Using SSL: $EASYRSA_OPENSSL $("$EASYRSA_OPENSSL" version)" ;;
+			*) die "\
+Missing or invalid OpenSSL
+Expected to find openssl command at: $EASYRSA_OPENSSL" ;;
+		esac
+	fi
+	EASYRSA_SSL_OK=1
+
+	# Verify EASYRSA_SSL_CONF file exists
+	[ -f "$EASYRSA_SSL_CONF" ] || die "\
+The OpenSSL config file cannot be found.
+Expected location: $EASYRSA_SSL_CONF"
+} # => verify_ssl_lib ()
+
 # Basic sanity-check of PKI init and complain if missing
 verify_pki_init() {
 	help_note="Run easyrsa without commands for usage and command help."
@@ -395,6 +397,9 @@ $help_note"
 Missing expected directory: $i (perhaps you need to run init-pki?)
 $help_note"
 	done
+
+	# verify ssl lib
+	verify_ssl_lib
 } # => verify_pki_init()
 
 # Verify core CA files present