nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Advanced.md: Correct auto-load order and Remove program location

Browse Source 
Correct auto-load order:
The previous order was to search the default PKI before EASYRSA.
Change: EASYRSA is moved to a higher priority than a default PKI.

Remove 'program location' as a valid target for auto-loading vars.
Keeping writable data files in the same folder as executable code
is not necessary.  If it is required then use of other options is
preferred. eg: --vars=<FILE> or $EASYRSA

Add additional information regarding use of default PKI.
Add section to advise the preferred use of --pki over --vars.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2023-09-24 16:30:43 +01:00
parent 060299f3df
commit ecd65065e3
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
doc/EasyRSA-Advanced.md
View File

@ -33,14 +33,27 @@ Configuration Reference
1. The file referenced by the `--vars` CLI option
2. The file referenced by the env-var named `EASYRSA_VARS_FILE`
3. The directory referenced by the `EASYRSA_PKI` env-var
4. The default PKI directory at `$PWD/pki`
4. The directory referenced by the `EASYRSA` env-var
5. The directory containing the easyrsa program
3. The directory referenced by the `--pki` CLI option (Recommended)
4. The directory referenced by the `EASYRSA_PKI` env-var
5. The directory referenced by the `EASYRSA` env-var
6. The default PKI directory at `$PWD/pki` (See note below)
7. The default working directory at `$PWD`
Defining the env-var `EASYRSA_NO_VARS` will override the sourcing of the vars
file in all cases, including defining it subsequently as a global option.
Note: If the vars file `$PWD/pki/vars` is sourced then it is forbidden from
setting/changing the current PKI, as defined by `EASYRSA_PKI` env-var.
#### Use of `--pki` verses `--vars`
It is recommended to use option `--pki=DIR` to define your PKI at runtime.
This method will always auto-load the `vars` file found in defined PKI.
In a multi-PKI installation, use of `--vars` can potentially lead to
a vars file that is configured to set a PKI which cannot be verified
as the expected PKI. Use of `--vars` is not recommended.
#### OpenSSL Config
Easy-RSA is tightly coupled to the OpenSSL config file (.cnf) for the