nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adding support back in for incremental serials

Browse Source 
Not enabled by default.  Should fix #177.

Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This commit is contained in:
Eric F Crist 2019-05-17 06:50:08 -05:00
parent 6b7b6bf1f0
commit 8374fcb4da
No known key found for this signature in database
GPG Key ID: 72964219390D0D0E
2 changed files with 20 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
easyrsa3/easyrsa
View File

@ -738,18 +738,21 @@ sign_req() {
crt_out="$EASYRSA_PKI/issued/$2.crt"
# Randomize Serial number
i=""
serial=""
check_serial=""
for i in 1 2 3 4 5; do
"$EASYRSA_OPENSSL" rand -hex -out "$EASYRSA_PKI/serial" 16
serial="$(cat "$EASYRSA_PKI/serial")"
check_serial="$("$EASYRSA_OPENSSL" ca -config "$EASYRSA_SSL_CONF" -status "$serial" 2>&1)"
case "$check_serial" in
*"not present in db"*) break ;;
*) continue ;;
esac
done
if [ "$EASYRSA_RAND_SN" != "no" ];
then
i=""
serial=""
check_serial=""
for i in 1 2 3 4 5; do
"$EASYRSA_OPENSSL" rand -hex -out "$EASYRSA_PKI/serial" 16
serial="$(cat "$EASYRSA_PKI/serial")"
check_serial="$("$EASYRSA_OPENSSL" ca -config "$EASYRSA_SSL_CONF" -status "$serial" 2>&1)"
case "$check_serial" in
*"not present in db"*) break ;;
*) continue ;;
esac
done
fi
# Support batch by internal caller:
[ "$3" = "batch" ] && EASYRSA_BATCH=1

5
easyrsa3/vars.example
View File

@ -137,6 +137,11 @@ fi
#set_var EASYRSA_CRL_DAYS 180
# Random serial numbers by default, set to no for the old incremental serial numbers
#
#set_var EASYRSA_RAND_SN "yes"
# Support deprecated "Netscape" extensions? (choices "yes" or "no".) The default
# is "no" to discourage use of deprecated extensions. If you require this
# feature to use with --ns-cert-type, set this to "yes" here. This support