Since EasyRSA version 3.1 there is a NEW insert-marker for X509 type 'ca'.
* New insert-marker: '^#%CA_X509_TYPES_EXTRA_EXTS%' [BRE]
This is only required to build a new CA or Sub-CA. However, without this
check, an old version of openssl-easyrsa.cnf will silently FAIL to include
the X509 types for 'ca' and 'COMMON', when builing a new CA.
EasyRSA 'init-pki soft' does leave 'openssl-easyrsa.cnf' in place, which
means that this is a known possible failure.
For consistency, check for All EasyRSA insert-markers, when used.
* Standard insert-markers: '^#%EXTRA_EXTS%' and '^#%COPY_EXTS%' [BRE]
Tested manually.
Closes: #693
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The extentions temp-file is part of the session temp-dir and is otherwise
removed by cleanup() on successful completion.
Part-of: #667Closes: #676
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Due to my previous misunderstanding of the intended use of --req-cn,
it is no longer possible to set commonName for command gen-req.
Ref: #524#456
This commit restores v30x series behavior:
* --req-cn can only be used in batch mode.
* --req-cn can only be used by commands build-ca and gen-req.
* SSL layer prompts are restored to original behavior.
Important: The use of internal batch mode is no longer required
for command sign_req(), when called by build_full(). This code
has been disabled but remains in place. This is a considerable
change under the hood but there is no user observable difference.
Also, minor improvements to help and EasyRSA-Advanced.md
Tested manually and thoroughly.
Closes: #668
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Option alias '--days=NUMBER' can now be used for all other options which
indicate a validity period.
* Option: --days
This global option is an alias for one of the following:
* Expiry days for a new CA.
eg: '--days=3650 build-ca'
* Expiry days for new/renewed certificate.
eg: '--days=1095 renew server'
* Expiry days for certificate revokation list.
eg: '--days=180 gen-crl'
* Cutoff days for commands: show-expire or renewable.
eg: '--days=90 show-expire'"
The alias '--days' is now ONLY applied to the variable which requires it.
eg: If building a certificate then the appropriate variable for that type
is set. The other possible uses are not set by the same use.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
--keep-tmp=NAME : Keep the original temporary session by name: NAME
NAME is a sub-directory of the dir declared by --tmp-dir
This option ALWAYS over-writes a sub-dir of the same name.
Closes: #610
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Locate existing x509-types directory, after sourcing vars.
If vars is set incorrectly then this WILL over-ride vars.
Closes: #654
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Squashed commit of the following:
commit 5e9609873a01dd358e3a4c6928fc553e5257d8ea
Merge: ed54b1a 42bfae4
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sun Aug 28 14:44:13 2022 +0100
Merge branch 'subca-default-cn' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-subca-default-cn
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit 42bfae4673996307107964be0fc8b15883072d31
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat Aug 27 13:20:41 2022 +0100
build-ca: Assign default sub-CA commonName and enable SSL interactive
When building a CA/SubCA, if a commonName has not been assigned by --req-cn
then assign a default commonName, of either:
* 'Easy-RSA CA' or 'Easy-RSA Sub-CA'.
If a default commonName has been assigned then use SSL interactive mode
to edit/confirm each of the subject fields individually. Otherwise, use
EasyRSA to confirm all of the subject fields with a single prompt.
Closes: #659
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Make find_x509_types_dir() a stand alone function.
When calling usage(), find_x509_types_dir() can be a soft fail.
When x509-types directory is required, this function is a hard fail.
This also simplifies install_data_to_pki(), because x509-types do not
need to be installed in the PKI.
Closes: #654
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Note: --req-cn can only be used when building a CA/subCA.
When building All other certificates --req-cn is not honoured.
Reported-in: #659
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Processing vars at init-pki was intentionally kept to minimum, due to
complications with user expectations verses Easy-RSA preferences.
This overhaul aims to finalise Easy-RSA interference with vars.
1. Prefer that vars is in the PKI but only force that at init-pki,
when no other vars files can be found. Otherwise, do not create a
template vars and leave it to the user, with appropriate messages.
2. Fail all commands, except init-pki, if more than one vars exists.
3. Take special care of 'init-pki soft'.
4. For existing PKIs, be aware that vars may NOT exist.
This patch is less complicated than it appears to be.
Most of the changes are either comments or user messages.
There are some new state flags to manage the location of vars,
which are used to decide when a new vars is created and control
user messages.
Closes: #651
New message for "Using x509-types directory: $EASYRSA_EXT_DIR"
Closes: #654
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Since the introduction of 'escape_hazard()' function, all characters
except (`) backtick are supported.
This patch brings vars.example in line with the warning in easyrsa and
also only warns about backtick.
It is possible that curly brace '{}' may also cause OpenSSL to behave
strangely. However, the strange behaviour, which I previously observed,
may have been rectified by OpenSSL.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Add warning for new password status, prior to renewal.
Add reminder to replace certificate AND key files, after renewal.
Correct input check for option 'nopass'
Closes: m#644
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Previously, testing vars for unsupported characters was only done if
vars was in the PKI. This test can now be done for all vars files.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The 3 definitions of $prog_dir:
- foo -> prog_dir=/search/path ## Not $PWD
- ./foo -> prog_dir=. ## $PWD
- /full/path/foo -> prog_dir=/full/path ## Could be $PWD
'/full/path' was previously missing from the check.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Since relaxing the rules concerning the location of vars file,
commit f4a604438d3ce5fe67a1f4db956dc42fc4ae5588, it is no longer
necessary to prohibit the use of --vars=file with 'init-pki'.
This initial prohibition was only a temporary measure and has
proven to be of no value.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
'shift 2' was moved above the parameter check in previous commit:
1d227736e404b805e84b8949aa238a240c4ad5eb
Move it back to after the check and reword user output for clarity.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
If verify_ca_init fails then the error message states that: 'serial
is missing'. While this is true, it is not 'user friendly'.
Reorder the checks so that if verify_ca_init fails then the error
message will "probably" state that: 'ca.crt is missing', which makes
more sense if the CA has not been initialised.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The command 'sign-req COMMON client1 nopass' would generate an invalid
certificate. Do not allow COMMON as a $cert_type.
Also, improve comment and user output for existing certificate check.
Closese: #634
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
If a user breaks out [Ctrl-C] from generating a DH parameters file
then there is an empty dh.pem file left over.
Output the DH parameters to a temp-file and move it upon validation
and completion.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Prefer /usr/local/share over /usr/share
and move /etc/easy-rsa to last place.
Tidy up a 'case', no functional change.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The utility script 'make-cadir' creates a CA directory with a vars file.
This vars file conflicts with the preferred PKI-vars file.
This patch changes 'init-pki' to allow make-cadir vars file to over-ride
the preferred PKI-vars file, without error.
Closes: #633
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
