nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Support for clientServer

Browse Source 
Merging PR #38

Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This commit is contained in:
Eric F Crist 2019-01-11 11:58:00 -06:00
parent e71f2013c7
commit bebd71e76f
No known key found for this signature in database
GPG Key ID: 72964219390D0D0E
3 changed files with 25 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1,4 +1,4 @@
easyrsa3/pki/* easyrsa3/pki
easyrsa3/vars easyrsa3/vars
dist-staging dist-staging
easyrsa3/safessl-easyrsa.cnf easyrsa3/safessl-easyrsa.cnf

16
easyrsa3/easyrsa
View File

@ -33,7 +33,12 @@ Here is the list of commands available with a short syntax reminder. Use the
sign-req <type> <filename_base> sign-req <type> <filename_base>
build-client-full <filename_base> [ cmd-opts ] build-client-full <filename_base> [ cmd-opts ]
build-server-full <filename_base> [ cmd-opts ] build-server-full <filename_base> [ cmd-opts ]
<<<<<<< HEAD
revoke <filename_base> [cmd-opts] revoke <filename_base> [cmd-opts]
=======
build-serverClient-full <filename_base> [ cmd-opts ]
revoke <filename_base>
>>>>>>> 3ec93810e45d1e684f902a9847a1afe3ffc87a04
gen-crl gen-crl
update-db update-db
show-req <filename_base> [ cmd-opts ] show-req <filename_base> [ cmd-opts ]
@ -85,14 +90,15 @@ cmd_help() {
sign|sign-req) text=" sign|sign-req) text="
sign-req <type> <filename_base> sign-req <type> <filename_base>
Sign a certificate request of the defined type. <type> must be a known Sign a certificate request of the defined type. <type> must be a known
type such as 'client', 'server', or 'ca' (or a user-added type.) type such as 'client', 'server', 'serverClient', or 'ca' (or a user-added type.)
This request file must exist in the reqs/ dir and have a .req file This request file must exist in the reqs/ dir and have a .req file
extension. See import-req below for importing reqs from other sources." ;; extension. See import-req below for importing reqs from other sources." ;;
build|build-client-full|build-server-full) text=" build|build-client-full|build-server-full|build-serverClient-full) text="
build-client-full <filename_base> [ cmd-opts ] build-client-full <filename_base> [ cmd-opts ]
build-server-full <filename_base> [ cmd-opts ] build-server-full <filename_base> [ cmd-opts ]
Generate a keypair and sign locally for a client or server build-serverClient-full <filename_base> [ cmd-opts ]
Generate a keypair and sign locally for a client and/or server
This mode uses the <filename_base> as the X509 CN." This mode uses the <filename_base> as the X509 CN."
opts=" opts="
@ -761,6 +767,7 @@ $(display_dn req "$req_in")
[ -n "$EASYRSA_NS_COMMENT" ] && \ [ -n "$EASYRSA_NS_COMMENT" ] && \
print "nsComment = \"$EASYRSA_NS_COMMENT\"" print "nsComment = \"$EASYRSA_NS_COMMENT\""
case "$crt_type" in case "$crt_type" in
serverClient) print "nsCertType = serverClient" ;;
server) print "nsCertType = server" ;; server) print "nsCertType = server" ;;
client) print "nsCertType = client" ;; client) print "nsCertType = client" ;;
ca) print "nsCertType = sslCA" ;; ca) print "nsCertType = sslCA" ;;
@ -1415,6 +1422,9 @@ case "$cmd" in
build-server-full) build-server-full)
build_full server "$@" build_full server "$@"
;; ;;
build-serverClient-full)
build_full serverClient "$@"
;;
gen-crl) gen-crl)
gen_crl gen_crl
;; ;;

8
easyrsa3/x509-types/serverClient Normal file
View File

@ -0,0 +1,8 @@
# X509 extensions for a client/server
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
extendedKeyUsage = serverAuth,clientAuth
keyUsage = digitalSignature,keyEncipherment