If this 'date' is MacPorts then it will fall throught to:
* This *is* the bottom-line, "date-wise": Ubuntu or busybox.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Use command option '--fix-offset=nnn' [nnn: 1 - 365] day number,
to set the date at which the certificate will become Valid.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When revoking a renewed certificate, do not delete PKCS files,
because they do not belong to the old certificate which was renewed.
Update warnings to reflect this change.
Add revocation "reason" to confirmation dialogues.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The original cert_dates(); was intended to restrict certificate renewal
to a fixed 30-day-window of the certificate expiry date. This was an
unnecessary restriction. Removed-by: #594
The original cert_dates(); "gave rise to" the Easy-RSA "ambition" to
support multiple versions of 'date' (*nix), which proved to be more
demanding than initially expected. The "new" code speaks for itself.
Currently supported versions of 'date', as of this pull request:
* Linux (Standard Ubuntu)
* FreeBSD
* MacOS and MacOS Ports
* busybox
New functions:
* cert_date_to_timestamp_s()
Takes* an X509 certificate date, as output by SSL option '-startdate'
or '-enddate' and creates a 'timestamp' in seconds since epoch.
* offset_days_to_cert_date() [Note: 'days' not 'date']
Adds* the $offset number of days to the current date and creates an
X509 "style" certificate date string.
* ff_date_to_cert_date()
Takes* a fixed-format date and converts it into an X509 certificate
"style" date string.
* ssl_cert_not_before_date()
Dedicated function to return an X509 certificate '-startdate' by SSL.
* ssl_cert_not_after_date()
Dedicated function to return an X509 certificate '-enddate' by SSL.
These functions serve to provide an extensible frame-work for Easy-RSA
to manage all 'date' requirements.
Extras:
Built in reports 'show-expire','show-revoke' and 'show-renew' all use
these functions to interrogate index.txt and the PKI, extensively.
Add error detection to Easy-RSA options which involve "number of days"
and fail for any input which is not a base-10 number. eg. --days=nn
Closes: #593
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Auto-escape '&' ampersand explanation:
'easyrsa' uses 'sed' to build a safe SSL config file, which means
that an unescaped '&' ampersand cannot be used in the 'vars' file.
This is due to 'sed' treating '&' as a special character.
Rather than expect users to know all this and use extended escaping,
to get around 'easyrsa' set_var(), use auto-escape. This allows use
of unescaped '&' in vars file. Like any other character.
Auto-escape '$' dollar-sign explanation:
Using '$' in the 'vars' file MUST be escaped. Escaping '$' to stop
expansion is common knowledge and the first thing a user will try.
Using an escaped '$' in the 'vars' file results in an unescaped '$'
being written to the SSL config file, which is then expanded by
OpenSSL or choked on by LibreSSL. Auto-escaping '$' fixes this.
Add SSL library name to die().
Allow verify_ssl_lib() to run ONLY once.
Improve comments.
Re-order the areas searched for data files to prioritise preferred
locations over old defaults.
Tested-with: OpenSSL and LibreSSL and on Windows and FreeBSD.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Changes:
* Improve help
* Move renew_restore_move() out of die() and back to renewal block.
* Minor corrections to user output.
* Add detailed description of which files will be moved/removed.
* Simplify check/create revoked/renewed directory structures.
* Only die on failure to move certificate, otherwise warn only.
Some files may not be present. eg. PKCS files, already removed.
Manually tested.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Having used help extensively, this reformats help for readability.
Both 'user output' and 'code style' _appear_ to be improved.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Use move not copy (copy was used in development).
Corrections to help and error messages.
Re-arrange "hand-off" 'case'; group renew functions together.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The original version of EasyRSA command 'renew', leaves the certificate
without a method to be revoked.
This is due to 'renew' moving files OUT of the PKI, which means they cannot
be targeted by command 'revoke'.
Additionally, 'renew' renames the files to an unfriendly serial-number.
--
Command 'rewind-renew' restores the original commonName as file-name-base.
And moves these files to renewed folders which are targeted by 'revoke-renewed'.
Closes: #578 (Thoroughly tested)
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command '[' uses '-n' by default:
* Never use '[ -n "$example" ]'
* Always use '[ "$example" ]'
This improves readabiity.
Use only '-e' to test for file existence.
Try to use simple tests, not 'not not X' (double negative) tests.
Example:
* [ "$EASYRSA_RAND_SERIAL != "no" ] = Replace with ' = "yes" '
Use 'shift' cleanly, immediately after assignment.
Improve/correct comments and user messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Use the flag as intended.
Also, improvements to layout and comments, in nearby functions.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
