From 8b1fe0152f8410553f991a3c4b5ae22c473fd2aa Mon Sep 17 00:00:00 2001 From: Josh Cepek Date: Sun, 8 Dec 2013 15:05:50 -0600 Subject: [PATCH] Support OpenSSL-0.9.8 with the EXTRA_EXTS feature OpenSSL-0.9.8 cannot handle an empty extensions section. This change has the dynamic extensions support place the section reference in the temporary file at runtime, supporting both 0.9.8 and 1.0.* versions. Signed-off-by: Josh Cepek --- easyrsa3/easyrsa | 6 +++++- easyrsa3/openssl-1.0.cnf | 4 +--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa index 827a287..4d33d37 100755 --- a/easyrsa3/easyrsa +++ b/easyrsa3/easyrsa @@ -508,12 +508,16 @@ Continuing with key generation will replace this key." # When EASYRSA_EXTRA_EXTS is defined, append it to openssl's [req] section: if [ -n "$EASYRSA_EXTRA_EXTS" ]; then + # Setup & insert the extra ext data keyed by a magic line + EASYRSA_EXTRA_EXTS=" +req_extensions = req_extra +[ req_extra ] +$EASYRSA_EXTRA_EXTS" local awkscript=' {if ( match($0, "^#%EXTRA_EXTS%") ) { while ( getline<"/dev/stdin" ) {print} next } {print} }' - # This awk inserts the extra ext data keyed by a magic line print "$EASYRSA_EXTRA_EXTS" | \ awk "$awkscript" "$EASYRSA_SSL_CONF" \ > "$EASYRSA_TEMP_FILE" \ diff --git a/easyrsa3/openssl-1.0.cnf b/easyrsa3/openssl-1.0.cnf index 5da819a..d9109b5 100644 --- a/easyrsa3/openssl-1.0.cnf +++ b/easyrsa3/openssl-1.0.cnf @@ -57,10 +57,8 @@ default_keyfile = privkey.pem default_md = $ENV::EASYRSA_DIGEST distinguished_name = $ENV::EASYRSA_DN x509_extensions = easyrsa_ca # The extentions to add to the self signed cert -# A section to handle the $EXTRA_EXTS feature -req_extensions = req_extra -[ req_extra ] +# A placeholder to handle the $EXTRA_EXTS feature: #%EXTRA_EXTS% # Do NOT remove or change this line as $EXTRA_EXTS support requires it ####################################################################