nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

X509-types: Always check SSL config file for EasyRSA insert-markers

Browse Source 
Since EasyRSA version 3.1 there is a NEW insert-marker for X509 type 'ca'.

* New insert-marker: '^#%CA_X509_TYPES_EXTRA_EXTS%' [BRE]

This is only required to build a new CA or Sub-CA. However, without this
check, an old version of openssl-easyrsa.cnf will silently FAIL to include
the X509 types for 'ca' and 'COMMON', when builing a new CA.

EasyRSA 'init-pki soft' does leave 'openssl-easyrsa.cnf' in place, which
means that this is a known possible failure.

For consistency, check for All EasyRSA insert-markers, when used.

* Standard insert-markers: '^#%EXTRA_EXTS%' and '^#%COPY_EXTS%' [BRE]

Tested manually.

Closes: #693

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-09-18 17:32:08 +01:00
parent d99bef68e1
commit 27c9905aa4
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
easyrsa3/easyrsa
View File

@ -1288,6 +1288,13 @@ $EASYRSA_PKI
Refusing to create a new CA keypair as this operation would overwrite your
current CA keypair. If you intended to start a new CA, run init-pki first."
# Check for insert-marker in ssl config file
if ! grep -q '^#%CA_X509_TYPES_EXTRA_EXTS%' "$EASYRSA_SSL_CONF"; then
die "\
The copy of openssl-easyrsa.cnf in your PKI does not have full support
for X509-type CA. Please update your copy to the official release."
fi
# create necessary files and dirs:
err_file="Unable to create necessary PKI files (permissions?)"
for i in issued certs_by_serial \
@ -1525,6 +1532,13 @@ Continuing with key generation will replace this key."
# When EASYRSA_EXTRA_EXTS is defined, append it to openssl's [req] section:
if [ "$EASYRSA_EXTRA_EXTS" ]; then
# Check for insert-marker in ssl config file
if ! grep -q '^#%EXTRA_EXTS%' "$EASYRSA_SSL_CONF"; then
die "\
The copy of openssl-easyrsa.cnf in your PKI does not have full support
for request extensions. Please update your copy to the official release."
fi
# Setup & insert the extra ext data keyed by a magic line
extra_exts="
req_extensions = req_extra
@ -1672,6 +1686,13 @@ $(display_dn req "$req_in")
# When EASYRSA_CP_EXT is defined, adjust openssl's [default_ca] section:
if [ "$EASYRSA_CP_EXT" ]; then
# Check for insert-marker in ssl config file
if ! grep -q '^#%COPY_EXTS%' "$EASYRSA_SSL_CONF"; then
die "\
The copy of openssl-easyrsa.cnf in your PKI does not have full support
for X509-type $crt_type. Please update your copy to the official release."
fi
# Setup & insert the copy_extensions data keyed by a magic line
copy_exts="copy_extensions = copy"
# shellcheck disable=SC2016 # vars don't expand in single quote