Add EASYRSA_CRL_DAYS to command to generate a new CRL.
Although this is taken care of in the SSL config file,
it is easier to understand by having the code incuded
in the script.
Honor batch mode and over write an existing CRL, with
out confirmation. An out dated CRL is of little value
and the user has specified batch mode, so honor it.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Using --fix-offset will not use -days, only -statdate/-enddate.
Options -startdate/-enddate are absolute dates, not counted from
today by OpenSSL, for any reason.
Fixes some unrelated warnings about incomplete SSL config file,
when using --fix-offset.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When EASYRSA_RAND_SN="no", the file pki/serial file is not meant to
be updated by easyrsa. OpenSSL manages the file itself.
Move the code to write the file pki/serial with a random number,
inside the if condition for EASYRSA_RAND_SN, so the file is only
written to by easyrsa, when a random serial number is expected.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This was used to define a temp-dir for a temp-file for EC params.
This was replaced by standard temp-file EASYRSA_ALGO_PARAMS.
The replacement was due to EasyRSA support for OpenSSL version 3,
where SSL command 'genpkey' replaced the previous commands.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Previously, set_var() had no input checking, combined with
the point that, via vars, set_var() is user facing, this
can lead to easy user errors.
Now, input is checked:
- Parameter 1 is required.
- Parameter 1 cannot contain a space.
- Less-than 3 input parameters are expected.
- Quote the expansion of the first occurence of parameter 1
in the evaluated expression.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This drops use of SSL to generate randomly numbered files.
The temp-session is still randomly named.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Move the sed command to a function and wrap long lines.
New function: easyrsa_rewrite_ssl_config()
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
force_set_var() is intended to deliberately over-write all prior values.
This also drops an unnecessary 'eval'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Remove unused EASYRSA_ININE, satisfy shellcheck.
Wrap long lines.
Minor improvements to comments and error messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This should have always been 'verify-cert' because it only verifies
to certificates. (Also change 'help' text)
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
safe_set_var(): Show offending input value in error output
Standardise similar functions:
* ssl_cert_serial()
* ssl_cert_not_before_date()
* ssl_cert_not_after_date
Wrap more long lines.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This only effects status_expire(), show-expire.
Add error detection for 'date' usage.
Wrap long lines.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
fixed_cert_dates(): Replace capturing subshell-output
by setting variables via safe_set_var().
Add error detection for 'date' usage.
Wrap long lines.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
The current code calculates --fix-offset=1 as January 2nd.
This decreases the input value by one, which results in
--fix-offset=1 being January 1st.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Option '--passout' MUST take priority over '--nopass' and 'nopass'.
Otherwise, the private key is unintentionally created unencrypted.
Option '--passin' must NOT take priority.
Otherwise, it is not possible to automatically create an entity
key without a password, if the CA key is created with a password.
Initialisation: Wrap long lines
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
