General improvements to revoke/renew/revoke-renewed
Ensure that declaration of file-names which are from serial-numbers are declared after the serial-number has been extracted. Move confirmation prompts to the last point before action. Correct and improve #comments, "prompts" and "error messages". Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme
parent
345341013c
commit
ac12dad028
170
easyrsa3/easyrsa
170
easyrsa3/easyrsa
@ -1393,13 +1393,13 @@ inline_creds ()
|
||||
|
||||
# revoke backend
|
||||
revoke() {
|
||||
verify_ca_init
|
||||
|
||||
# pull filename base:
|
||||
[ "$1" ] || die "\
|
||||
Error: didn't find a file base name as the first argument.
|
||||
Run easyrsa without commands for usage and command help."
|
||||
|
||||
verify_ca_init
|
||||
|
||||
# Assign file_name_base and dust off!
|
||||
file_name_base="$1"
|
||||
shift
|
||||
@ -1440,13 +1440,6 @@ Run easyrsa without commands for usage and command help."
|
||||
Unable to revoke as no certificate was found. Certificate was expected
|
||||
at: $crt_in"
|
||||
|
||||
# confirm operation by displaying DN:
|
||||
confirm "Continue with revocation: " "yes" "
|
||||
Please confirm you wish to revoke the certificate with the following subject:
|
||||
|
||||
$(display_dn x509 "$crt_in")
|
||||
" # => confirm end
|
||||
|
||||
# Verify certificate
|
||||
verify_file x509 "$crt_in" || die "\
|
||||
Unable to revoke as the input file is not a valid certificate. Unexpected
|
||||
@ -1466,6 +1459,24 @@ Unexpected input in file: $req_in"
|
||||
cert_serial="${cert_serial##*=}"
|
||||
duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"
|
||||
|
||||
# Set out_dir
|
||||
out_dir="$EASYRSA_PKI/revoked"
|
||||
crt_out="$out_dir/certs_by_serial/$cert_serial.crt"
|
||||
key_out="$out_dir/private_by_serial/$cert_serial.key"
|
||||
req_out="$out_dir/reqs_by_serial/$cert_serial.req"
|
||||
|
||||
# NEVER over-write a revoked cert, serial number must be unique
|
||||
[ -e "$crt_out" ] && die "revoked exists: $crt_out"
|
||||
[ -e "$key_out" ] && die "revoked exists: $key_out"
|
||||
[ -e "$req_out" ] && die "revoked exists: $req_out"
|
||||
|
||||
# confirm operation by displaying DN:
|
||||
confirm "Continue with revocation: " "yes" "
|
||||
Please confirm you wish to revoke the certificate with the following subject:
|
||||
|
||||
$(display_dn x509 "$crt_in")
|
||||
" # => confirm end
|
||||
|
||||
# Revoke certificate
|
||||
easyrsa_openssl ca -utf8 -revoke "$crt_in" \
|
||||
${crl_reason+ -crl_reason "$crl_reason"} \
|
||||
@ -1473,7 +1484,7 @@ Unexpected input in file: $req_in"
|
||||
|| die "Failed to revoke certificate: revocation command failed."
|
||||
|
||||
# move revoked files so we can reissue certificates with the same name
|
||||
move_revoked
|
||||
revoke_move
|
||||
|
||||
[ "$EASYRSA_SILENT" ] || print # Separate Notice below
|
||||
notice "\
|
||||
@ -1487,20 +1498,9 @@ infrastructure in order to prevent the revoked cert from being accepted."
|
||||
} #= revoke()
|
||||
|
||||
# move-revoked
|
||||
# moves revoked certificates to an alternative folder
|
||||
# moves revoked certificates to the 'revoked' folder
|
||||
# allows reissuing certificates with the same name
|
||||
move_revoked() {
|
||||
# Set out_dir
|
||||
out_dir="$EASYRSA_PKI/revoked"
|
||||
crt_out="$out_dir/certs_by_serial/$cert_serial.crt"
|
||||
key_out="$out_dir/private_by_serial/$cert_serial.key"
|
||||
req_out="$out_dir/reqs_by_serial/$cert_serial.req"
|
||||
|
||||
# NEVER over-write a revoked cert, serial number must be unique
|
||||
[ -e "$crt_out" ] && die "revoked exists: $crt_out"
|
||||
[ -e "$key_out" ] && die "revoked exists: $key_out"
|
||||
[ -e "$req_out" ] && die "revoked exists: $req_out"
|
||||
|
||||
revoke_move() {
|
||||
# make sure revoked dirs exist
|
||||
if [ ! -d "$out_dir" ]; then
|
||||
mkdir -p "$out_dir" || die "Failed to mkdir: $out_dir"
|
||||
@ -1527,10 +1527,13 @@ move_revoked() {
|
||||
# move any pkcs files
|
||||
for pkcs in p12 p7b p8 p1; do
|
||||
if [ -e "$in_dir/issued/$file_name_base.$pkcs" ]; then
|
||||
# issued
|
||||
mv "$in_dir/issued/$file_name_base.$pkcs" \
|
||||
"$out_dir/certs_by_serial/$cert_serial.$pkcs" \
|
||||
|| die "Failed to move: $file_name_base.$pkcs"
|
||||
|
||||
elif [ -e "$in_dir/private/$file_name_base.$pkcs" ]; then
|
||||
# private
|
||||
mv "$in_dir/private/$file_name_base.$pkcs" \
|
||||
"$out_dir/private_by_serial/$cert_serial.$pkcs" \
|
||||
|| die "Failed to move: $file_name_base.$pkcs"
|
||||
@ -1554,13 +1557,13 @@ move_revoked() {
|
||||
|
||||
# renew backend
|
||||
renew() {
|
||||
verify_ca_init
|
||||
|
||||
# pull filename base:
|
||||
[ "$1" ] || die "\
|
||||
Error: didn't find a file base name as the first argument.
|
||||
Run easyrsa without commands for usage and command help."
|
||||
|
||||
verify_ca_init
|
||||
|
||||
# Assign file_name_base and dust off!
|
||||
file_name_base="$1"
|
||||
shift
|
||||
@ -1591,13 +1594,6 @@ Run easyrsa without commands for usage and command help."
|
||||
Unable to renew as no certificate was found. Certificate was expected
|
||||
at: $crt_in"
|
||||
|
||||
# confirm operation by displaying DN:
|
||||
confirm "Continue with renew: " "yes" "
|
||||
Please confirm you wish to renew the certificate with the following subject:
|
||||
|
||||
$(display_dn x509 "$crt_in")
|
||||
" # => confirm end
|
||||
|
||||
# Verify certificate
|
||||
verify_file x509 "$crt_in" || die "\
|
||||
Unable to renew as the input file is not a valid certificate. Unexpected
|
||||
@ -1617,6 +1613,21 @@ Unexpected input in file: $req_in"
|
||||
cert_serial="${cert_serial##*=}"
|
||||
duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"
|
||||
|
||||
# Set out_dir
|
||||
out_dir="$EASYRSA_PKI/renewed"
|
||||
crt_out="$out_dir/issued/$file_name_base.crt"
|
||||
key_out="$out_dir/private/$file_name_base.key"
|
||||
req_out="$out_dir/reqs/$file_name_base.req"
|
||||
|
||||
# NEVER over-write a renewed cert, revoke it first
|
||||
deny_msg="\
|
||||
Cannot renew this certificate because a conflicting file exists.
|
||||
*"
|
||||
[ -e "$crt_out" ] && die "$deny_msg certificate: $crt_out"
|
||||
[ -e "$key_out" ] && die "$deny_msg private key: $key_out"
|
||||
[ -e "$req_out" ] && die "$deny_msg request : $req_out"
|
||||
unset -v deny_msg
|
||||
|
||||
# Check if old cert is expired or expires within 30
|
||||
cert_expire_date="$(
|
||||
easyrsa_openssl x509 -in "$crt_in" -noout -enddate | \
|
||||
@ -1673,8 +1684,8 @@ Renewal not allowed."
|
||||
: # ok - Use current subjectAltName
|
||||
else
|
||||
san="$(
|
||||
easyrsa_openssl x509 -in "$crt_in" -noout -text |
|
||||
sed -n "/X509v3 Subject Alternative Name:/{n;s/IP Address:/IP:/;s/ //g;p;}"
|
||||
easyrsa_openssl x509 -in "$crt_in" -noout -text | sed -n \
|
||||
"/X509v3 Subject Alternative Name:/{n;s/IP Address:/IP:/;s/ //g;p;}"
|
||||
)"
|
||||
|
||||
[ -n "$san" ] && export EASYRSA_EXTRA_EXTS="\
|
||||
@ -1682,8 +1693,15 @@ $EASYRSA_EXTRA_EXTS
|
||||
subjectAltName = $san"
|
||||
fi
|
||||
|
||||
# confirm operation by displaying DN:
|
||||
confirm "Continue with renew: " "yes" "
|
||||
Please confirm you wish to renew the certificate with the following subject:
|
||||
|
||||
$(display_dn x509 "$crt_in")
|
||||
" # => confirm end
|
||||
|
||||
# move renewed files so we can reissue certificate with the same name
|
||||
move_renewed
|
||||
renew_move
|
||||
|
||||
# renew certificate
|
||||
build_full "$cert_type" "$file_name_base" "$opt_nopass" || die "\
|
||||
@ -1701,20 +1719,9 @@ You may want to revoke the old certificate once the new one has been deployed."
|
||||
} #= renew()
|
||||
|
||||
# move-renewed
|
||||
# moves renewed certificates to an alternative folder
|
||||
# moves renewed certificates to the 'renewed' folder
|
||||
# allows reissuing certificates with the same name
|
||||
move_renewed() {
|
||||
# Set out_dir
|
||||
out_dir="$EASYRSA_PKI/renewed"
|
||||
crt_out="$out_dir/issued/$file_name_base.crt"
|
||||
key_out="$out_dir/private/$file_name_base.key"
|
||||
req_out="$out_dir/reqs/$file_name_base.req"
|
||||
|
||||
# NEVER over-write a renewed cert, revoke it first
|
||||
[ -e "$crt_out" ] && die "renewed exists: $crt_out"
|
||||
[ -e "$key_out" ] && die "renewed exists: $key_out"
|
||||
[ -e "$req_out" ] && die "renewed exists: $req_out"
|
||||
|
||||
renew_move() {
|
||||
# make sure renewed dirs exist
|
||||
if [ ! -d "$out_dir" ]; then
|
||||
mkdir -p "$out_dir" || die "Failed to mkdir: $out_dir"
|
||||
@ -1741,10 +1748,12 @@ move_renewed() {
|
||||
# move any pkcs files
|
||||
for pkcs in p12 p7b p8 p1; do
|
||||
if [ -e "$in_dir/issued/$file_name_base.$pkcs" ]; then
|
||||
# issued
|
||||
mv "$in_dir/issued/$file_name_base.$pkcs" \
|
||||
"$out_dir/issued/$file_name_base.$pkcs" \
|
||||
|| die "Failed to move: $file_name_base.$pkcs"
|
||||
elif [ -e "$in_dir/private/$file_name_base.$pkcs" ]; then
|
||||
# private
|
||||
mv "$in_dir/private/$file_name_base.$pkcs" \
|
||||
"$out_dir/private/$file_name_base.$pkcs" \
|
||||
|| die "Failed to move: $file_name_base.$pkcs"
|
||||
@ -1768,13 +1777,13 @@ move_renewed() {
|
||||
|
||||
# revoke-renewed backend
|
||||
revoke_renewed() {
|
||||
verify_ca_init
|
||||
|
||||
# pull filename base:
|
||||
[ "$1" ] || die "\
|
||||
Error: didn't find a file base name as the first argument.
|
||||
Run easyrsa without commands for usage and command help."
|
||||
|
||||
verify_ca_init
|
||||
|
||||
# Assign file_name_base and dust off!
|
||||
file_name_base="$1"
|
||||
shift
|
||||
@ -1812,27 +1821,20 @@ Run easyrsa without commands for usage and command help."
|
||||
|
||||
# referenced cert must exist:
|
||||
[ -f "$crt_in" ] || die "\
|
||||
Unable to revoke as no renewed certificate was found. Certificate was expected
|
||||
at: $crt_in"
|
||||
|
||||
# confirm operation by displaying DN:
|
||||
confirm "Continue with revocation: " "yes" "
|
||||
Please confirm you wish to revoke the renewed certificate with serial $1 and the following subject:
|
||||
|
||||
$(display_dn x509 "$crt_in")
|
||||
" # => confirm end
|
||||
Unable to revoke as no renewed certificate was found.
|
||||
Certificate was expected at: $crt_in"
|
||||
|
||||
# Verify certificate
|
||||
verify_file x509 "$crt_in" || die "\
|
||||
Unable to revoke as the certificate serial does not match an old one of a valid renewed certificate. Unexpected
|
||||
certificate in file: $crt_in"
|
||||
Unable to revoke as the input file is not a valid certificate. Unexpected
|
||||
input in file: $crt_in"
|
||||
|
||||
# Verify request
|
||||
if [ -e "$req_in" ]
|
||||
then
|
||||
verify_file req "$req_in" || die "\
|
||||
Unable to move renewed then revoked request. The file is not a valid request. Unexpected
|
||||
input in file: $req_in"
|
||||
Unable to move request. The file is not a valid request.
|
||||
Unexpected input in file: $req_in"
|
||||
fi
|
||||
|
||||
# get the serial number of the certificate -> serial=XXXX
|
||||
@ -1841,14 +1843,33 @@ input in file: $req_in"
|
||||
# remove the serial= part -> we only need the XXXX part
|
||||
cert_serial="${cert_serial##*=}"
|
||||
|
||||
# shellcheck disable=SC2086
|
||||
# output
|
||||
out_dir="$EASYRSA_PKI/revoked"
|
||||
crt_out="$out_dir/certs_by_serial/$cert_serial.crt"
|
||||
key_out="$out_dir/private_by_serial/$cert_serial.key"
|
||||
req_out="$out_dir/reqs_by_serial/$cert_serial.req"
|
||||
|
||||
# NEVER over-write a revoked cert, serial number must be unique
|
||||
[ -e "$crt_out" ] && die "revoked exists: $crt_out"
|
||||
[ -e "$key_out" ] && die "revoked exists: $key_out"
|
||||
[ -e "$req_out" ] && die "revoked exists: $req_out"
|
||||
|
||||
# confirm operation by displaying DN:
|
||||
confirm " Continue with revocation: " "yes" "
|
||||
Please confirm you wish to revoke the renewed certificate
|
||||
with serial $1 and the following subject:
|
||||
|
||||
$(display_dn x509 "$crt_in")
|
||||
" # => confirm end
|
||||
|
||||
# Revoke the old (already renewed) certificate
|
||||
easyrsa_openssl ca -utf8 -revoke "$crt_in" \
|
||||
${crl_reason:+ -crl_reason "$crl_reason"} \
|
||||
${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
|
||||
|| die "Failed to revoke renewed certificate: revocation command failed."
|
||||
|
||||
# move revoked files
|
||||
move_renewed_revoked
|
||||
revoke_renewed_move
|
||||
|
||||
notice "\
|
||||
IMPORTANT!!!
|
||||
@ -1861,22 +1882,11 @@ infrastructure in order to prevent the revoked renewed cert from being accepted.
|
||||
} #= revoke_renewed()
|
||||
|
||||
# move-renewed-revoked
|
||||
# moves renewed then revoked certificates to an alternative folder
|
||||
move_renewed_revoked() {
|
||||
# output
|
||||
out_dir="$EASYRSA_PKI/revoked"
|
||||
crt_out="$out_dir/certs_by_serial/$cert_serial.crt"
|
||||
key_out="$out_dir/private_by_serial/$cert_serial.key"
|
||||
req_out="$out_dir/reqs_by_serial/$cert_serial.req"
|
||||
|
||||
# NEVER over-write a revoked cert, serial number must be unique
|
||||
[ -e "$crt_out" ] && die "revoked exists: $crt_out"
|
||||
[ -e "$key_out" ] && die "revoked exists: $key_out"
|
||||
[ -e "$req_out" ] && die "revoked exists: $req_out"
|
||||
|
||||
# moves renewed then revoked certificates to the 'revoked' folder
|
||||
revoke_renewed_move() {
|
||||
# make sure revoked dirs exist
|
||||
if [ ! -d "$out_dir" ]; then
|
||||
mkdir -p "$out_dir" || die "move_renewed_revoked - Failed to mkdir: $out_dir"
|
||||
mkdir -p "$out_dir" || die "Failed to mkdir: $out_dir"
|
||||
fi
|
||||
for target in certs_by_serial private_by_serial reqs_by_serial; do
|
||||
[ -d "$out_dir/$target" ] && continue
|
||||
@ -1900,10 +1910,12 @@ move_renewed_revoked() {
|
||||
# move any pkcs files
|
||||
for pkcs in p12 p7b p8 p1; do
|
||||
if [ -e "$in_dir/issued/$file_name_base.$pkcs" ]; then
|
||||
# issued
|
||||
mv "$in_dir/issued/$file_name_base.$pkcs" \
|
||||
"$out_dir/certs_by_serial/$cert_serial.$pkcs" \
|
||||
|| die "Failed to move: $file_name_base.$pkcs"
|
||||
elif [ -e "$in_dir/private/$file_name_base.$pkcs" ]; then
|
||||
# private
|
||||
mv "$in_dir/private/$file_name_base.$pkcs" \
|
||||
"$out_dir/private_by_serial/$cert_serial.$pkcs" \
|
||||
|| die "Failed to move: $file_name_base.$pkcs"
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user