From 5c36c478fbe96d7bc09a7406c1446267c3b4760e Mon Sep 17 00:00:00 2001 From: Richard T Bonhomme Date: Wed, 23 Nov 2022 21:53:46 +0000 Subject: [PATCH] vars.example: Add EASYRSA_NO_PASS and wrap long lines Signed-off-by: Richard T Bonhomme --- easyrsa3/vars.example | 96 ++++++++++++++++++++++++------------------- 1 file changed, 54 insertions(+), 42 deletions(-) diff --git a/easyrsa3/vars.example b/easyrsa3/vars.example index e5407cb..d10275a 100644 --- a/easyrsa3/vars.example +++ b/easyrsa3/vars.example @@ -7,12 +7,12 @@ # HOW TO USE THIS FILE # # vars.example contains built-in examples to Easy-RSA settings. You MUST name -# this file "vars" if you want it to be used as a configuration file. If you do -# not, it WILL NOT be automatically read when you call easyrsa commands. +# this file "vars" if you want it to be used as a configuration file. If you +# do not, it WILL NOT be automatically read when you call easyrsa commands. # # It is not necessary to use this config file unless you wish to change -# operational defaults. These defaults should be fine for many uses without the -# need to copy and edit the "vars" file. +# operational defaults. These defaults should be fine for many uses without +# the need to copy and edit the "vars" file. # # All of the editable settings are shown commented and start with the command # "set_var" -- this means any set_var command that is uncommented has been @@ -22,8 +22,8 @@ # NOTES FOR WINDOWS USERS # # Paths for Windows *MUST* use forward slashes, or optionally double-escaped -# backslashes (single forward slashes are recommended.) This means your path to -# the openssl binary might look like this: +# backslashes (single forward slashes are recommended.) This means your path +# to the openssl binary might look like this: # "C:/Program Files/OpenSSL-Win32/bin/openssl.exe" # A little housekeeping: DO NOT EDIT THIS SECTION @@ -31,8 +31,8 @@ # Easy-RSA 3.x does not source into the environment directly. # Complain if a user tries to do this: if [ -z "$EASYRSA_CALLER" ]; then - echo "You appear to be sourcing an Easy-RSA *vars* file." >&2 - echo "This is no longer necessary and is disallowed. See the section called" >&2 + echo "You appear to be sourcing an Easy-RSA *vars* file. This is" >&2 + echo "no longer necessary and is disallowed. See the section called" >&2 echo "*How to use this file* near the top comments for more details." >&2 return 1 fi @@ -40,7 +40,7 @@ fi # DO YOUR EDITS BELOW THIS POINT # This variable is used as the base location of configuration files needed by -# easyrsa. More specific variables for specific files (e.g., EASYRSA_SSL_CONF) +# easyrsa. More specific variables for specific files (eg: EASYRSA_SSL_CONF) # may override this default. # # The default value of this variable is the location of the easyrsa script @@ -49,8 +49,8 @@ fi # #set_var EASYRSA "${0%/*}" -# If your OpenSSL command is not in the system PATH, you will need to define the -# path to it here. Normally this means a full path to the executable, otherwise +# If your OpenSSL command is not in the system PATH, you will need to define +# the path here. Normally this means a full path to the executable, otherwise # you could have left it undefined here and the shown default would be used. # # Windows users, remember to use paths with forward-slashes (or escaped @@ -62,12 +62,12 @@ fi # This sample is in Windows syntax -- edit it for your path if not using PATH: #set_var EASYRSA_OPENSSL "C:/Program Files/OpenSSL-Win32/bin/openssl.exe" -# Edit this variable to point to your soon-to-be-created key directory. By -# default, this will be "$PWD/pki" (i.e. the "pki" subdirectory of the +# Edit this variable to point to your soon-to-be-created key directory. +# By default, this will be "$PWD/pki" (ie: the "pki" subdirectory of the # directory you are currently in). # # WARNING: init-pki will do a rm -rf on this directory so make sure you define -# it correctly! (Interactive mode will prompt before acting.) +# it correctly! Interactive mode will prompt before acting. # #set_var EASYRSA_PKI "$PWD/pki" @@ -76,21 +76,23 @@ fi #set_var EASYRSA_TEMP_DIR "$EASYRSA_PKI" # Define X509 DN mode. -# This is used to adjust what elements are included in the Subject field as the DN -# (this is the "Distinguished Name.") -# Note that in cn_only mode the Organizational fields further below are not used. +# +# This is used to adjust which elements are included in the Subject field +# as the DN ("Distinguished Name"). Note that in 'cn_only' mode the +# Organizational fields, listed further below, are not used. # # Choices are: -# cn_only - use just a CN value -# org - use the "traditional" Country/Province/City/Org/OU/email/CN format +# cn_only - Use just a commonName value. +# org - Use the "traditional" format: +# Country/Province/City/Org/Org.Unit/email/commonName # #set_var EASYRSA_DN "cn_only" -# Organizational fields (used with "org" mode and ignored in "cn_only" mode.) +# Organizational fields (used with "org" mode and ignored in "cn_only" mode). # These are the default values for fields which will be placed in the # certificate. Do not leave any of these fields blank, although interactively # you may omit any specific field by typing the "." symbol (not valid for -# email.) +# email). # # NOTE: The following characters are not supported # in these "Organizational fields" by Easy-RSA: @@ -103,11 +105,18 @@ fi #set_var EASYRSA_REQ_EMAIL "me@example.net" #set_var EASYRSA_REQ_OU "My Organizational Unit" -# Choose a size in bits for your keypairs. The recommended value is 2048. Using -# 2048-bit keys is considered more than sufficient for many years into the -# future. Larger keysizes will slow down TLS negotiation and make key/DH param -# generation take much longer. Values up to 4096 should be accepted by most -# software. Only used when the crypto alg is rsa (see below.) +# Set no password mode - This will create the entire PKI without passwords. +# This can be better managed by choosing which entity private keys should be +# encrypted with the following command line options: +# Global option '--no-pass' or command option 'nopass'. +# +#set_var EASYRSA_NO_PASS 1 + +# Choose a size in bits for your keypairs. The recommended value is 2048. +# Using 2048-bit keys is considered more than sufficient for many years into +# the future. Larger keysizes will slow down TLS negotiation and make key/DH +# param generation take much longer. Values up to 4096 should be accepted by +# most software. Only used when the crypto alg is rsa, see below. # #set_var EASYRSA_KEY_SIZE 2048 @@ -132,12 +141,14 @@ fi # #set_var EASYRSA_CERT_EXPIRE 825 -# How many days until the next CRL publish date? Note that the CRL can still be -# parsed after this timeframe passes. It is only used for an expected next +# How many days until the next CRL publish date? Note that the CRL can still +# be parsed after this timeframe passes. It is only used for an expected next # publication date. +# #set_var EASYRSA_CRL_DAYS 180 -# Random serial numbers by default, set to no for the old incremental serial numbers +# Random serial numbers by default. +# Set to 'no' for the old incremental serial numbers. # #set_var EASYRSA_RAND_SN "yes" @@ -149,14 +160,14 @@ fi # #set_var EASYRSA_FIX_OFFSET 1 -# Support deprecated "Netscape" extensions? (choices "yes" or "no".) The default -# is "no" to discourage use of deprecated extensions. If you require this -# feature to use with --ns-cert-type, set this to "yes" here. This support -# should be replaced with the more modern --remote-cert-tls feature. If you do -# not use --ns-cert-type in your configs, it is safe (and recommended) to leave -# this defined to "no". When set to "yes", server-signed certs get the -# nsCertType=server attribute, and also get any NS_COMMENT defined below in the -# nsComment field. +# Support deprecated "Netscape" extensions? (choices "yes" or "no"). +# The default is "no", to discourage use of deprecated extensions. +# If you require this feature to use with --ns-cert-type, set this to "yes". +# This support should be replaced with the more modern --remote-cert-tls +# feature. If you do not use --ns-cert-type in your configs, it is safe, +# and recommended, to leave this defined to "no". +# When set to "yes", server-signed certs get the nsCertType=server attribute +# and also get any NS_COMMENT defined below in the nsComment field. # #set_var EASYRSA_NS_SUPPORT "no" @@ -191,16 +202,17 @@ fi # #set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types" -# DEPRECATED +# Non-functional # If you want to generate KDC certificates, you need to set the realm here. +# #set_var EASYRSA_KDC_REALM "CHANGEME.EXAMPLE.COM" # OpenSSL config file: # If you need to use a specific openssl config file, you can reference it here. -# Normally this file is auto-detected from a file named openssl-easyrsa.cnf from the -# EASYRSA_PKI or EASYRSA dir (in that order.) NOTE that this file is Easy-RSA -# specific and you cannot just use a standard config file, so this is an -# advanced feature. +# Normally this file is auto-detected from a file named openssl-easyrsa.cnf +# from the EASYRSA_PKI or EASYRSA dir, in that order. NOTE that this file is +# Easy-RSA specific and you cannot just use a standard config file, so this is +# an advanced feature. # #set_var EASYRSA_SSL_CONF "$EASYRSA_PKI/openssl-easyrsa.cnf"