Perform hierarchial decision for elliptic curve name.
Default curves per algorithm:
* 'ec' Elliptic curve name 'secp384r1' (Unchanged)
* 'ed' Edwards curve name 'ed25519' (Changed)
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This will only effect a CA built with custom EASYRSA_EXTRA_EXTS;
The solution being, to use the correct 'openssl-easyrsa.cnf'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Where errors are known, exit via 'Known' branch.
Allow preset error number to propagate.
Long line wrapping. Shorten associated variable names.
Move clearing traps to within cleanup().
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
If 'easyrsa' is being run by the unit-test then allow the default method
for 'build-ca' to be exercised.
The default 'easyrsa' method is to use temp-files, generated by EasyRSA,
to pass the CA passphrase, provided by the user, to the SSL command.
The normal 'unit-test' method to use a passphrase is to configure EasyRSA
ommand line options '--passin' and '--passout'.
The change made here is to simulate user-interaction and to supply a
default passphrase, as a user, to the SSL command.
To NOT use EasyRSA command line options to set any passphrase.
ONLY when being run by the unit-test.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Using OpenSSL 3.0.7, packaged by OpenVPN Windows installer, causes
EasyRSA command 'build-ca' to fail, because it does not have an input
password to re-open the private key, which is required to generate
the CA certificate.
Provide the user specified CA passphrase as input password for build-ca.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When using set_var() with a variable as in input for name of the variable,
use this wrapper to verify the input is suitable as a variable name.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command show-expire:
Improve report outut to show 'expired: <date>' for expired certificates.
Otherwise, show 'expires: <date>' for currently Valid certicates.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Some commands must capture the SSL output via a subshell.
eg: ssl_cert_serial() and ssl_cert_not_before/after_date()
To use easyrsa_openssl() for these commands, EASYRSA_DEBUG must be disabled.
This patch unsets EASYRSA_DEBUG in the function subshells only.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Always assign the easyrsa_openssl() temp-file before escape_hazard().
In the event of failure, easyrsa_openssl() will try first.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Currently, --fix-offset does not allow creating post-dated cerificates.
Instead, it rolls the start date back by one year.
The reason for this behavior is that --fix-offest was only meant to fix
a day of the year but not which year.
This patch simply removes the check for a post-dated certificate, which
allows `not-before-date` to be set upto one year in the future.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
