verify_algo_params() expects errors when settings are not corrrect.
Therefore, is must not use easyrsa_openssl() meta-wrapper, which would
error out with a misleading error message.
Fixing this also ensures that the SAFE SSL config is not built prior
to EASYRSA_REQ_CN being set.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
EASYRSA_KEY_SIZE is present in the SSL config file, therefore,
it MUST always be set, regardless of EASYRSA_ALGO in use.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command 'easyrsa_openssl makesafecnf' is used internally to create a safe
SSL config file. (By status reports, read_db())
Once the safe SSL config file has been named as a temp-file and created,
the script continues to use that temp-file as the master copy, it does not
recreate a safe SSL config file for subsequent calls to easyrsa_openssl().
Therefore, the temp-file MUST be copied to the standard safe SSL file not
moved. Otherwise, the named temp-file is removed.
Also, move the assignment of the safe SSL temp-file to the correct place.
This means that a new temp-file wiill only be assigned once.
Also, verify that the safe SSL temp-file exists when it is expected to.
Also, change use of '--no--safe-ssl' with LibreSSL to a FATAL error.
Other changes are for error and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
X509-types insert markers are used by 'awk' to insert data at specific
points in the easyrsa-openssl.cnf file in use.
The checks are moved to below more important imput checks
For build-ca, the check is ONLY done if EASYRSA_EXTRA_EXTS is defined.
This is exceedingly unlikely, because EASYRSA_EXTRA_EXTS is not documented.
For sign-req, the check is only done if --copy-ext isused.
Also, remove an over-indent in "Confirm use of NS extestions"
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
* gen-req: Use verify_pki_init().
* sign-req: Use verify_ca_init().
* build-full: Defer requirements to functions above.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
In verify_working_env(), move to AFTER the check for temporary folder.
The move is aesthetic because secure_session() does its own check
for temporary folder.
In 'init-pki', remove secure_session() completely, as not required.
Add more verbose output.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
easyrsa_openssl() default behaviour is to re-use the generated
safe SSL config file, after bieng called for the first time.
NOTE: easyrsa_openssl() is a heavily nested function.
This option forces recreation of a safe SSL config file for each
call to easyrsa_openssl().
Only effective when an SSL config fie is required.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Status reports function read_db() MUST recreate the secure session
for each record of the database being read.
Introduce remove_secure_session(), to remove the session and reset
related flags:
- secure_session: The directory name of the session. Deleted.
- working_safe_ssl_conf - Safe SSL config file. Deleted.
- mktemp_counter - Count of temp files. Deleted.
Also use remove_secure_session() in cleanup().
Improve some verbose output.
Wrap some long lines.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
If the certificate does not exist then the database date is used.
The database date is a shortened ISO-8601 date, the certifcate date
is presented in a completely different format.
Omit the calculated "seconds since epoch" double check via 'date',
when the certificate does not exist.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit df0a19e7ebaba5cb6fd2787ce4747d6338447a0a
Merge: e3e9f9e a7e58dd
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Apr 8 14:30:46 2023 +0100
Merge branch 'easyrsa_mktemp-increase-depth' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-easyrsa_mktemp-increase-depth
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit a7e58dd70cb2aeb06ebee39c6b2c438e9ac76cdc
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Apr 8 02:43:20 2023 +0100
verify_algo_params(): Edwards Curve, call OpenSSL directly
This allows the output to be discarded via /dev/null, because
there is no use of temp-files and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit d64dfcc16676b1e1b3fda7090667aea76bd718fc
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Apr 8 02:13:29 2023 +0100
easyrsa_mktemp(): Windows, 'set -o noclobber' to control 'mv.exe'
Currently, mv.exe will always prompt before over-writing a file.
When creating temp-files, mv.exe must NEVER prompt but silently
fail and try again with a new, sequentially numbered, file-name.
Using 'set -o noclobber' causes mv.exe to behave correctly here.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit 948e1a1fbb338a32cf9b42d6fe9801b0fe7bfde9
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Apr 8 01:22:47 2023 +0100
easyrsa_mktemp(): Allow nine (9) test files
Use of easyrsa_openssl() creates temp-files by default
and is used in subshells. This requires maximum of (7)
seven test files to move the shot-file to. (Currently)
Raise the the number of test-files to maximum nine (9).
Status reports, read_db(): Recreate temporary session
directory for each record. 'easyrsa' is designed to run
one command and then exit, removing the temp session.
Status reports run 'easyrsa' for the number of records
in the database, before exiting. Therefore, the temp
session MUST be reset for eash record read.
Add verbose output to help debug easyrsa_mktemp problems.
Improve comments.
Complete renaming of
- EASYRSA_CERT_RENEW -to- EASYRSA_PRE_EXPIRY_WINDOW
Split vars_setup(), add verify_working_env()
- vars_setup() now only processes vars file.
- verify_working_env() does the rest.
The split does not change any of the enclosed code.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
