From 7aa52b75f4d26c50ede9f4657a1daeeeba3abcb6 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Wed, 8 Jun 2022 16:26:34 +0100
Subject: [PATCH] Do not delete PKCS files when using revoke_renewed()

When revoking a renewed certificate, do not delete PKCS files,
because they do not belong to the old certificate which was renewed.

Update warnings to reflect this change.

Add revocation "reason" to confirmation dialogues.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 34 +++++++---------------------------
 1 file changed, 7 insertions(+), 27 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 377722a..8418d82 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1759,7 +1759,8 @@ with the following subject:
   $(display_dn x509 "$crt_in")
 
   serial-number: $cert_serial
-"	# => confirm end
+
+  Reason: ${crl_reason-None given}"
 
 	# Revoke certificate
 	easyrsa_openssl ca -utf8 -revoke "$crt_in" \
@@ -1969,8 +1970,7 @@ with the following subject:
 
   $(display_dn x509 "$crt_in")
 
-  serial-number: $cert_serial
-"	# => confirm end
+  serial-number: $cert_serial"
 
 	# move renewed files so we can reissue certificate with the same name
 	renew_move
@@ -2189,12 +2189,7 @@ This process is destructive!
 These files will be moved to the 'revoked' storage sub-directory:
 * $crt_in
 * $key_in
-* $req_in
-
-These files will be DELETED:
-* All PKCS files for commonName : $file_name_base
-* The inline credentials file   : $creds_in
-* The duplicate certificate     : $duplicate_crt_by_serial"
+* $req_in"
 
 	confirm "  Continue with revocation: " "yes" "\
   Please confirm you wish to revoke the renewed certificate
@@ -2203,11 +2198,12 @@ These files will be DELETED:
   $(display_dn x509 "$crt_in")
 
   serial-number: $cert_serial
-"	# => confirm end
+
+  Reason: ${crl_reason-None given}"
 
 	# Revoke the old (already renewed) certificate
 	easyrsa_openssl ca -utf8 -revoke "$crt_in" \
-		${crl_reason:+ -crl_reason "$crl_reason"} \
+		${crl_reason+ -crl_reason "$crl_reason"} \
 		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
 			|| die "Failed to revoke renewed certificate: revocation command failed."
 
@@ -2249,22 +2245,6 @@ revoke_renewed_move() {
 		mv "$req_in" "$req_out" || warn "Failed to move: $req_in"
 	fi
 
-	# move any pkcs files
-	for pkcs in p12 p7b p8 p1; do
-		if [ -e "$in_dir/issued/$file_name_base.$pkcs" ]; then
-			# issued
-			rm "$in_dir/issued/$file_name_base.$pkcs" ||
-				warn "Failed to remove: $file_name_base.$pkcs"
-
-		elif [ -e "$in_dir/private/$file_name_base.$pkcs" ]; then
-			# private
-			rm "$in_dir/private/$file_name_base.$pkcs" ||
-				warn "Failed to remove: $file_name_base.$pkcs"
-		else
-			: # ok
-		fi
-	done
-
 	return 0
 } # => revoke_renewed_move()