EasyrSA options to pass values directly to SSL options:
* EasyRSA --startdate=YYYYMMDDhhmmssZ -> SSL -startdate YYYYMMDDhhmmssZ
* EasyRSA --enddate=YYYYMMDDhhmmssZ -> SSL -enddate YYYYMMDDhhmmssZ
Note: Use of --enddate over-rides EASYRSA_CERT_EXPIRE (--days).
Establish requirements for use of --startdate and --enddate
Option --startdate MANDATES the use of --enddate. Otherwise, the valid
period counts from NOW. If --startdate is 6 months into the future and
--days is set to '1' then the certificate will expire in one 1 day but
not be valid for 6 months. Exit on improper use of --startdate.
Option --enddate is ONLY supported by commands which use 'sign-req'.
Warn when command does not support --enddate.
Use of --enddate MANDATES over-ruling --days.
Warn when --enddate will over-rule --days.
Correct user confirmation dialogue to reflect either number of --days
or date specified by --enddate.
Officially terminate support for --fix-offset.
Move "mutual exclusions" to a function.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Redirect SSL command error-output to /dev/null (2>/dev/null)
Requires batch mode, otherwise output intended for the user
is also redirected. In batch mode there is no output intended
for the user.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Forbid use of 'export' in 'vars' file.
Use one instance of 'grep' to test for prohibited strings.
Move log-output of 'vars' file location to before sourcing it.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
EasyRSA allows variables to be set to "" [null], therefore, as a
standard, the script now always tests for null or unset.
IE. Include the colon ':'.
The obvious exception to this is set_var(), which remains as test
for unset ONLY.
set_var() ONLY assigns a value if the variable is currently unset,
otherwise, it would over-write a deliberately empty value.
Also, where it helps readability, separate the expansion operator
from the expandable value, with a space.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Add EASYRSA_CRL_DAYS to command to generate a new CRL.
Although this is taken care of in the SSL config file,
it is easier to understand by having the code incuded
in the script.
Honor batch mode and over write an existing CRL, with
out confirmation. An out dated CRL is of little value
and the user has specified batch mode, so honor it.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Using --fix-offset will not use -days, only -statdate/-enddate.
Options -startdate/-enddate are absolute dates, not counted from
today by OpenSSL, for any reason.
Fixes some unrelated warnings about incomplete SSL config file,
when using --fix-offset.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When EASYRSA_RAND_SN="no", the file pki/serial file is not meant to
be updated by easyrsa. OpenSSL manages the file itself.
Move the code to write the file pki/serial with a random number,
inside the if condition for EASYRSA_RAND_SN, so the file is only
written to by easyrsa, when a random serial number is expected.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
