safe_set_var(): Show offending input value in error output
Standardise similar functions:
* ssl_cert_serial()
* ssl_cert_not_before_date()
* ssl_cert_not_after_date
Wrap more long lines.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This only effects status_expire(), show-expire.
Add error detection for 'date' usage.
Wrap long lines.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
fixed_cert_dates(): Replace capturing subshell-output
by setting variables via safe_set_var().
Add error detection for 'date' usage.
Wrap long lines.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The current code calculates --fix-offset=1 as January 2nd.
This decreases the input value by one, which results in
--fix-offset=1 being January 1st.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Option '--passout' MUST take priority over '--nopass' and 'nopass'.
Otherwise, the private key is unintentionally created unencrypted.
Option '--passin' must NOT take priority.
Otherwise, it is not possible to automatically create an entity
key without a password, if the CA key is created with a password.
Initialisation: Wrap long lines
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Only if a PKI currently exists, add a second confirmation to promote
the use of 'init-pki soft'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Perform hierarchial decision for elliptic curve name.
Default curves per algorithm:
* 'ec' Elliptic curve name 'secp384r1' (Unchanged)
* 'ed' Edwards curve name 'ed25519' (Changed)
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This will only effect a CA built with custom EASYRSA_EXTRA_EXTS;
The solution being, to use the correct 'openssl-easyrsa.cnf'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Where errors are known, exit via 'Known' branch.
Allow preset error number to propagate.
Long line wrapping. Shorten associated variable names.
Move clearing traps to within cleanup().
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
If 'easyrsa' is being run by the unit-test then allow the default method
for 'build-ca' to be exercised.
The default 'easyrsa' method is to use temp-files, generated by EasyRSA,
to pass the CA passphrase, provided by the user, to the SSL command.
The normal 'unit-test' method to use a passphrase is to configure EasyRSA
ommand line options '--passin' and '--passout'.
The change made here is to simulate user-interaction and to supply a
default passphrase, as a user, to the SSL command.
To NOT use EasyRSA command line options to set any passphrase.
ONLY when being run by the unit-test.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Using OpenSSL 3.0.7, packaged by OpenVPN Windows installer, causes
EasyRSA command 'build-ca' to fail, because it does not have an input
password to re-open the private key, which is required to generate
the CA certificate.
Provide the user specified CA passphrase as input password for build-ca.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When using set_var() with a variable as in input for name of the variable,
use this wrapper to verify the input is suitable as a variable name.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command show-expire:
Improve report outut to show 'expired: <date>' for expired certificates.
Otherwise, show 'expires: <date>' for currently Valid certicates.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Some commands must capture the SSL output via a subshell.
eg: ssl_cert_serial() and ssl_cert_not_before/after_date()
To use easyrsa_openssl() for these commands, EASYRSA_DEBUG must be disabled.
This patch unsets EASYRSA_DEBUG in the function subshells only.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Always assign the easyrsa_openssl() temp-file before escape_hazard().
In the event of failure, easyrsa_openssl() will try first.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
