From 5d3344006993a130e20ffce835af6f55bf44466f Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat, 11 Mar 2023 16:24:28 +0000
Subject: [PATCH 1/3] Introduce option -S|--silent-ssl: Silence SSL output

Redirect SSL command error-output to /dev/null (2>/dev/null)

Requires batch mode, otherwise output intended for the user
is also redirected.  In batch mode there is no output intended
for the user.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 38 ++++++++++++++++++++++++++++++++------
 1 file changed, 32 insertions(+), 6 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 9b4df69..2112fdc 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -464,6 +464,7 @@ General options:
 --batch         : Set automatic (no-prompts when possible) mode
 --silent|-s     : Disable all warnings, notices and information
 --sbatch        : Combined --silent and --batch operating mode
+--silent-ssl|-S : Silence SSL output (Requires bach mode)
 
 --no-pass       : Do not use passwords
                   Can not be used with --passin or --passout
@@ -775,9 +776,10 @@ export EASYRSA_REQ_SERIAL=\"$EASYRSA_REQ_SERIAL\"
 escape_hazard - Failed to write temp-file"
 
 	# Reload fields from fully escaped temp-file
-	# shellcheck disable=SC1090 # can't follow non-constant source.
+	# shellcheck disable=SC1090 # can't follow ...
 	(. "$easyrsa_vars_org") || die "\
 escape_hazard - Failed to source temp-file"
+	# shellcheck disable=SC1090 # can't follow ...
 	. "$easyrsa_vars_org"
 } # => escape_hazard()
 
@@ -891,14 +893,29 @@ easyrsa_openssl() {
 
 	elif [ "$has_config" ]; then
 		# Exec SSL with -config temp-file
-		"$EASYRSA_OPENSSL" "$openssl_command" \
-			-config "$easyrsa_safe_ssl_conf" "$@" && \
-				return
+		if [ "$EASYRSA_SILENT_SSL" ] && [ "$EASYRSA_BATCH" ]
+		then
+			"$EASYRSA_OPENSSL" "$openssl_command" \
+				-config "$easyrsa_safe_ssl_conf" "$@" \
+				2>/dev/null && \
+					return
+		else
+			"$EASYRSA_OPENSSL" "$openssl_command" \
+				-config "$easyrsa_safe_ssl_conf" "$@" && \
+					return
+		fi
 
 	else
 		# Exec SSL without -config temp-file
-		"$EASYRSA_OPENSSL" "$openssl_command" "$@" && \
-				return
+		if [ "$EASYRSA_SILENT_SSL" ] && [ "$EASYRSA_BATCH" ]
+		then
+			"$EASYRSA_OPENSSL" "$openssl_command" "$@" \
+				2>/dev/null && \
+					return
+		else
+			"$EASYRSA_OPENSSL" "$openssl_command" "$@" && \
+					return
+		fi
 	fi
 
 	# Always fail here
@@ -5561,6 +5578,10 @@ while :; do
 		export EASYRSA_SILENT=1
 		export EASYRSA_BATCH=1
 		;;
+	-S|--silent-ssl)
+		empty_ok=1
+		export EASYRSA_SILENT_SSL=1
+		;;
 	--no-safe-ssl)
 		empty_ok=1
 		export EASYRSA_NO_SAFE_SSL=1
@@ -5655,6 +5676,11 @@ if [ "$EASYRSA_PASSOUT" ]; then
 	unset -v EASYRSA_NO_PASS
 	prohibit_no_pass=1
 fi
+# --silent-ssl requires --batch
+if [ "$EASYRSA_SILENT_SSL" ]; then
+	[ "$EASYRSA_BATCH" ] || warn "\
+Option --silent-ssl requires batch mode --batch."
+fi
 
 # Hand off to the function responsible
 case "$cmd" in

From fc6d827196aa3c8321195f0529e2b0a5a29dc624 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat, 11 Mar 2023 16:26:15 +0000
Subject: [PATCH 2/3] ChangeLog: Introduce option -S|--silent-ssl: Silence SSL
 output

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index f355007..9d1ca5f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,7 @@
 Easy-RSA 3 ChangeLog
 
 3.1.3 (ETA: 2023-10-13)
+   * Introduce option -S|--silent-ssl: Silence SSL output (#913)
    * Only create a random serial number file when expected (#896)
    * Always verify SSL lib, for all commands (#877)
    * Option --fix-offset: Adjust off-by-one day (#847)

From 71bd6ae9308566bf58d19d3c5753dd3d7e6f5d2c Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Mon, 13 Mar 2023 16:59:51 +0000
Subject: [PATCH 3/3] easyrsa_openssl(): Improve failure message

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 2112fdc..ad2b34b 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -919,7 +919,10 @@ easyrsa_openssl() {
 	fi
 
 	# Always fail here
-	die "easyrsa_openssl - $openssl_command failed"
+	die "\
+easyrsa_openssl - Command has failed:
+* $EASYRSA_OPENSSL $openssl_command \
+${has_config:+-config $easyrsa_safe_ssl_conf }$*"
 } # => easyrsa_openssl()
 
 # Verify the SSL library is functional and establish version dependencies