Required changes:
* Use 'verify_ssl_lib()' to determine SSL Library version.
Returns '1', '3' OR error.
Sets 'no_password' to either '-nodes' (SSLv1) or '-noenc' (SSLv3)
* Replace OpenSSL paramater '-nodes' [DEPRECATED], with '-noenc'.
Ref: https://www.openssl.org/docs/man3.0/man1/openssl-req.html
This effects All Easy-RSA CAs built using OpenSSL version 3.
* Replace OpenSSL command 'genrsa' [DEPRECATED], with 'genpkey'.
Ref: https://www.openssl.org/docs/man3.0/man1/openssl-genrsa.html
This effects Easy-RSA 'RSA' CAs built using OpenSSL version 3.
OpenSSL advises using 'genpkey' over 'genrsa'.
* OpenSSL 'genpkey' does not accept the parameters defined by
easyrsa $opts and $no_password when generating CA private keys.
Do not use these variables for OpenSSL-v3 'genpkey'.
Optional changes:
* Use 'easyrsa_openssl()' wrapper function to build All CAs.
* Add 'genpkey' to easyrsa_openssl() wrapper, to include using the
EasyRSA/OpenSSL Configuration file $EASYRSA_SAFE_CONF.
* Change EasyRSA Elliptic Curve (ec) CA's to also use OpenSSL 'genpkey',
instead of OpenSSL 'ec'. This change is not required, however, this
means that all EasyRSA CA Private keys are created using 'genpkey'
with OpenSSL v3.
* EasyRSA 'gen_req()' is the only other code which uses OpenSSL '-nodes'.
Make 'gen_req()' aware of the SSL Library version and therefore the
correct parameter for an unencrypted private key. (-noenc vs -nodes)
Note: OpenSSL '-nodes' is only deprecated not removed.
* Indent OpenSSL version 1 code block to match. No functional changes.
Tests Passed:
Full extended unit tests, with both OpenSSL version 1.1.x and 3.0.1
(Includes standard test for Edwards Curve PKI)
Manual building of All OpenSSL *v3* CAs with passwords and subsequent
building and signing of a server or client certificate.
Manual building of OpenSSL *v1* EC CA with password and subsequent
building and signing of a server or client certificate.
Tested due to changing CA key from OpenSSL 'ec' to 'genpkey'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This removes our dependency on an external non-POSIX mktemp
implementation and uses openssl's built in rand function.
Addresses #478
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
The openssl call relied on word splitting for $crypto_ops
but $crypto_opts consists of a path which could contain spaces.
Now path is stored in $pass_opts which is quoted when using in
openssl call.
Using another build of OpenSSL that appears to work fine in testing.
Long term, we should be building OpenSSL ourselves and shipping it on a
regular basis. That's another project on the list.
Resolves#405.
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This reverts commit 5f3e5ca450eaf464ed21a5d3ec62d39f7594fd99.
There is an incompatibility in 1.1.1g with the EasyRSA script. There
are no new features in 1.1.1g we are leveraging directly, so just going
to revert to support the OpenVPN 2.5 release process and get EasyRSA
v3.x into more hands.
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
Commit 1e98ba8 introduced an issue with RSA keys (only ED keys were
tested).
Closes#403 and #395
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This fixes an argument error I made in commit 1e98ba808c9c90629595827773a66b59f8c9b927, sorry I have not tested RSA keys as I only use ED.
The argument is -passout for all openssl versions (tested on LibreSSL 2.8.3 and OpenSSL 1.1.1d).
When a vars file cannot be found, the up23_manage_upgrade_23() function
will now exit and print a message stating such. Previously, it exited
silently.
Fixes#377.
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This resolves a bug where build_ca ignores the nopass flag and always makes non-encrypted private keys when ALGO is "ed".
Also solves build_ca handling of EASYRSA_PASSOUT argument when generating private keys with ALGO set to "ed".
Merge branch 'madmajestro-use-passin-update-db'
Adds support for leveraging the --passin option for the CA private key
password when running the update-db command.
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
Merge branch 'madmajestro-setpass-never-returns-0-in-batchmode'
Similar bug to what was fixed in 2953817, with the same fix.
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
Merge branch 'madmajestro-imrove-returncode-notice-and-warn'
This resolves a bug where the warn() and notice() functions would
produce a non-zero exit during batch mode operations. This bug was
introduced by me in 09e2c3b.
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
The functions notice() and warn() allways exited with an return-code !=
0 if called in batch-mode, which can cause unexpected behavior in the
calling code. Now it is ensured that they return with succes.
Additinally, the Script will now terminate if the printf command in the
function print() fails. This ensures that errors during
output-generation will not be ignored.
