From 6436eaf8c1e5e3c44d23c1c7a0a5fef14f19d375 Mon Sep 17 00:00:00 2001
From: Martin Schmitt <mas@scsy.de>
Date: Fri, 30 Jun 2017 16:12:13 +0200
Subject: [PATCH 1/2] Add CN as SAN (if none requested) on server certs by
 default

---
 easyrsa3/easyrsa | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 088faeb..f5ec797 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -627,6 +627,15 @@ $(display_dn req "$req_in")
 			esac
 		fi
 
+		# If type is server and no subjectAltName was requested,
+		# add one to the extensions file
+		if [[ "$crt_type" == 'server' ]]
+		then
+			echo "$EASYRSA_EXTRA_EXTS" | 
+				grep -q subjectAltName || 
+				print $(default_server_san "$req_in")
+		fi
+
 		# Add any advanced extensions supplied by env-var:
 		[ -n "$EASYRSA_EXTRA_EXTS" ] && print "$EASYRSA_EXTRA_EXTS"
 		
@@ -923,6 +932,22 @@ display_dn() {
 	print "$("$EASYRSA_OPENSSL" $format -in "$path" -noout -subject -nameopt multiline)"
 } # => display_dn()
 
+# generate default SAN from req/X509, passed by full pathname
+default_server_san() {
+	local path="$1"
+	local cn=$(
+		"$EASYRSA_OPENSSL" req -in "$path" -noout -subject -nameopt sep_multiline |
+		awk -F'=' '/^  *CN=/{print $2}'
+		)
+	echo "$cn" | egrep -q '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$'
+	if [[ $? -eq 0 ]]
+	then
+		print "subjectAltName = IP:$cn"
+	else
+		print "subjectAltName = DNS:$cn"
+	fi
+} # => default_server_san()
+
 # verify a file seems to be a valid req/X509
 verify_file() {
 	local format="$1" path="$2"

From e9e8e272e0eb5225ecfb0d8a0953a5b480c5e85d Mon Sep 17 00:00:00 2001
From: Martin Schmitt <mas@scsy.de>
Date: Fri, 30 Jun 2017 17:04:31 +0200
Subject: [PATCH 2/2] Moved @ValdikSS's serial randomization to sign_req

---
 easyrsa3/easyrsa | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index f5ec797..cff63f2 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -569,6 +569,18 @@ sign_req() {
 	local req_in="$EASYRSA_PKI/reqs/$2.req"
 	local crt_out="$EASYRSA_PKI/issued/$2.crt"
 
+	# Randomize Serial number
+	local i= serial= check_serial=
+	for i in 1 2 3 4 5; do
+		"$EASYRSA_OPENSSL" rand -hex 16 -out "$EASYRSA_PKI/serial"
+		serial="$(cat "$EASYRSA_PKI/serial")"
+		check_serial="$("$EASYRSA_OPENSSL" ca -config "$EASYRSA_SSL_CONF" -status "$serial" 2>&1)"
+		case "$check_serial" in
+			*"not present in db"*) break ;;
+			*) continue ;;
+		esac
+	done
+
 	# Support batch by internal caller:
 	[ "$3" = "batch" ] && local EASYRSA_BATCH=1
 
@@ -661,17 +673,6 @@ Certificate created at: $crt_out
 build_full() {
 	verify_ca_init
 
-	local i= serial= check_serial=
-	for i in 1 2 3 4 5; do
-		"$EASYRSA_OPENSSL" rand -hex 16 -out "$EASYRSA_PKI/serial"
-		serial="$(cat "$EASYRSA_PKI/serial")"
-		check_serial="$("$EASYRSA_OPENSSL" ca -config "$EASYRSA_SSL_CONF" -status "$serial" 2>&1)"
-		case "$check_serial" in
-			*"not present in db"*) break ;;
-			*) continue ;;
-		esac
-	done
-
 	# pull filename base:
 	[ -n "$2" ] || die "\
 Error: didn't find a file base name as the first argument.