Use x509-types 'ca' and COMMON when building a CA

To sign a request, easyrsa uses 'openssl ca', which does support -extfile.

To create a CA, easyrsa uses 'openssl req', which does not support -extfile.

Therefore, the x509-types 'ca' and COMMON files cannot be specified using
-extfile to create a CA. Instead, they must be included within the SSL
config file, which 'openssl req' does support.

Using the same awk script from gen_req(), with New Token '#%X509_TYPES%',
the x509-types files 'ca' and COMMON are inserted into the SSL config file.

Closes: #525

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>

easyrsa3/easyrsa

@@ -828,6 +828,21 @@ current CA keypair. If you intended to start a new CA, run init-pki first."
 		fi
 	fi
 
+	# Insert x509-types COMMON and 'ca'
+	#shellcheck disable=SC2016
+	awkscript='
+{if ( match($0, "^#%X509_TYPES%") )
+	{ while ( getline<"/dev/stdin" ) {print} next }
+ {print}
+}'
+	conf_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"
+	cat "${EASYRSA_EXT_DIR}/ca" "${EASYRSA_EXT_DIR}/COMMON" | \
+		awk "$awkscript" "$EASYRSA_SSL_CONF" \
+		> "$conf_tmp" \
+		|| die "Copying SSL config to temp file failed"
+	# Use this new SSL config for the rest of this function
+	EASYRSA_SSL_CONF="$conf_tmp"
+
 	# Choose SSL Library version (1 or 3) and build CA
 	case "$osslv_major" in # => BEGIN SSL lib version
 

easyrsa3/openssl-easyrsa.cnf

@@ -128,6 +128,9 @@ keyUsage = cRLSign, keyCertSign
 # nsCertType omitted by default. Let's try to let the deprecated stuff die.
 # nsCertType = sslCA
 
+# A placeholder to handle the $X509_TYPES:
+#%X509_TYPES%	# Do NOT remove or change this line as $X509_TYPES demands it
+
 # CRL extensions.
 [ crl_ext ]