nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chicken/Egg config writing fixed

Browse Source 
Only write out the default config to EASYRSA_PKI during init-pki
function call.  Assume it's there or error out when appropriate.

Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This commit is contained in:
Eric F Crist 2018-09-15 10:43:49 -05:00
parent bb9b0b7543
commit f6d8a9903b
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
easyrsa3/easyrsa
View File

@ -415,7 +415,6 @@ $help_note"
# init-pki backend: # init-pki backend:
init_pki() { init_pki() {
vars_source_check
# If EASYRSA_PKI exists, confirm before we rm -rf (skiped with EASYRSA_BATCH) # If EASYRSA_PKI exists, confirm before we rm -rf (skiped with EASYRSA_BATCH)
if [ -e "$EASYRSA_PKI" ]; then if [ -e "$EASYRSA_PKI" ]; then
@ -432,6 +431,11 @@ and initialize a fresh PKI here."
for i in private reqs; do for i in private reqs; do
mkdir -p "$EASYRSA_PKI/$i" || die "Failed to create PKI file structure (permissions?)" mkdir -p "$EASYRSA_PKI/$i" || die "Failed to create PKI file structure (permissions?)"
done done
if [ ! -f "$EASYRSA_PKI/openssl-easyrsa.cnf" -a -f "$EASYRSA/openssl-easyrsa.cnf" ];
then
cp "$EASYRSA/openssl-easyrsa.cnf" "$EASYRSA_PKI/openssl-easyrsa.cnf"
fi
notice "\ notice "\
init-pki complete; you may now create a CA or requests. init-pki complete; you may now create a CA or requests.
@ -1180,18 +1184,15 @@ Note: using Easy-RSA configuration from: $vars"
set_var EASYRSA_REQ_CN ChangeMe set_var EASYRSA_REQ_CN ChangeMe
set_var EASYRSA_DIGEST sha256 set_var EASYRSA_DIGEST sha256
# Detect openssl config, preferring EASYRSA_PKI over EASYRSA set_var EASYRSA_SSL_CONF "$EASYRSA_PKI/openssl-easyrsa.cnf"
if [ -f "$EASYRSA_PKI/openssl-easyrsa.cnf" ]; then set_var EASYRSA_SAFE_CONF "$EASYRSA_PKI/safessl-easyrsa.cnf"
set_var EASYRSA_SSL_CONF "$EASYRSA_PKI/openssl-easyrsa.cnf"
set_var EASYRSA_SAFE_CONF "$EASYRSA_PKI/safessl-easyrsa.cnf"
else set_var EASYRSA_SSL_CONF "$EASYRSA/openssl-easyrsa.cnf"
set_var EASYRSA_SAFE_CONF "$EASYRSA/safessl-easyrsa.cnf"
fi
# Same as above for the x509-types extensions dir # Same as above for the x509-types extensions dir
if [ -d "$EASYRSA_PKI/x509-types" ]; then if [ -d "$EASYRSA_PKI/x509-types" ]; then
set_var EASYRSA_EXT_DIR "$EASYRSA_PKI/x509-types" set_var EASYRSA_EXT_DIR "$EASYRSA_PKI/x509-types"
else set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types" else
#TODO: This should be removed. Not really suitable for packaging.
set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types"
fi fi
# EASYRSA_ALGO_PARAMS must be set depending on selected algo # EASYRSA_ALGO_PARAMS must be set depending on selected algo