nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'TinCanTech-get-ca-password'

Browse Source 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-11-27 16:57:49 +00:00
commit a51278be73
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 54 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

72
easyrsa3/easyrsa
View File

@ -1260,6 +1260,27 @@ hide_read_pass()
return 0 return 0
} # => hide_read_pass() } # => hide_read_pass()
# Get passphrase
get_passphrase() {
while :; do
r=""
printf '\n%s' "$prompt"
hide_read_pass r
if [ -z "$r" ]; then
printf '\n%s\n' "Passphrase must not be empty!"
elif [ "${#r}" -lt 4 ]; then
printf '\n%s\n' "Passphrase must be at least 4 characters!"
else
unset -v "$@"
set_var "$@" "$r" || die "Passphrase error!"
unset -v r
print
return 0
fi
done
} # => get_passphrase()
# build-ca backend: # build-ca backend:
build_ca() { build_ca() {
cipher="-aes256" cipher="-aes256"
@ -1353,28 +1374,38 @@ Please update openssl-easyrsa.cnf to the latest official release."
fi fi
fi fi
out_key_tmp="$(easyrsa_mktemp)" || die "Failed to create temp-key file" # Assign cert and key temp files
out_file_tmp="$(easyrsa_mktemp)" || die "Failed to create temp-cert file" out_key_tmp="$(easyrsa_mktemp)" || \
die "Failed to create temp-key file"
out_file_tmp="$(easyrsa_mktemp)" || \
die "Failed to create temp-cert file"
# Get password from user if necessary # Get passphrase from user if necessary
if [ "$EASYRSA_NO_PASS" ]; then if [ "$EASYRSA_NO_PASS" ]; then
: # No password required : # No passphrase required
elif [ "$EASYRSA_PASSOUT" ] && [ "$EASYRSA_PASSIN" ]; then elif [ "$EASYRSA_PASSOUT" ] && [ "$EASYRSA_PASSIN" ]; then
: # Password defined : # passphrase defined
else else
out_key_pass_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file" # Assign passphrase vars and temp file
echo p=""
printf "Enter New CA Key Passphrase: " q=""
hide_read_pass kpass out_key_pass_tmp="$(easyrsa_mktemp)" || \
echo die "Failed to create temporary file"
printf "Re-Enter New CA Key Passphrase: "
hide_read_pass kpass2 # Get passphrase
echo prompt="Enter New CA Key Passphrase: "
# shellcheck disable=2154 # var is referenced but not assigned get_passphrase p
if [ "$kpass" = "$kpass2" ]; then
printf "%s" "$kpass" > "$out_key_pass_tmp" # Confirm passphrase
prompt="Confirm New CA Key Passphrase: "
get_passphrase q
# Validate passphrase
if [ "$p" = "$q" ]; then
printf "%s" "$p" > "$out_key_pass_tmp"
unset -v p q
else else
die "Passphrases do not match." die "Passphrases do not match!"
fi fi
fi fi
@ -1451,9 +1482,14 @@ Please update openssl-easyrsa.cnf to the latest official release."
*) die "build-ca ssl lib: $osslv_major" *) die "build-ca ssl lib: $osslv_major"
esac esac
# Remove passphrase temp-file
if [ -f "$out_key_pass_tmp" ]; then
rm "$out_key_pass_tmp" || die "\
Failed to remove the CA passphrase temp-file!"
fi
mv "$out_key_tmp" "$out_key" mv "$out_key_tmp" "$out_key"
mv "$out_file_tmp" "$out_file" mv "$out_file_tmp" "$out_file"
[ -f "$out_key_pass_tmp" ] && rm "$out_key_pass_tmp"
# Success messages # Success messages
if [ "$sub_ca" ]; then if [ "$sub_ca" ]; then