When signing a request, EasyRSA ALWAYS defaults to the CA defined
Distinguished Name field order, as defined by openssl-easyrsa.cnf
configuration file.
In the unlikely event that a CSR is received with a different DN-
field order, that order can be preserved for the signed certificate.
Command 'sign-req', now has a command option 'preserve' for this.
Additional:
Use of 'preserve = yes' in openssl-easyrsa.cnf has no effect for
EasyRSA.
Testing OpenSSL directly indicates that this option may have no effect
when used in OpenSSL default configuration file openssl.cnf
Also, OpenSSL documentation for command 'ca', option '-preserveDN'
does NOT infer that this option can be used in the configuration file.
None of which is important to EasyRSA because only foreign CSRs can
have a different DN-field order, so default behavior can remain.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Initial commit of a quick attempt at making a build script for OpenSSL.
This assumes some things present on my build VM. Appears to work at
least on an Ubuntu VM as well as on a Mac as long as mingw is installed.
Signed-off-by: Eric F Crist <ecrist@secure-computing.net>
This option bypasses the Easy-RSA code to manage the CA password.
The result is that the User MUST enter the CA password THREE times.
These three inputs are made directly to the SSL binary.
Easy-RSA will remain unaware of the CA password.
This is the most reliable way for Easy-RSA to create a CA, with a
password, without writing that password to a temp-file.
Equivalent to global option: '--raw-ca'
Usage:
* Command option: 'easyrsa build-ca raw-ca'
* Global option: 'easyrsa --raw-ca build-ca'
When specified, in ANY form, 'raw' method ALWAYS takes pririoty.
This change COMPLETELY removes the '--ca-via-stdin' method (v3.1.4),
which did not offer any more secuity than the standard method.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
If this code s left in then the unit test always falls through to
testing a CA without a password.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Change the integration of the following:
* build-ca: Replace password temp-file method with file-descriptors
* commit 27870d695a324e278854146afdac5d6bdade9bba
Instead of 'replacing' the standard temp-file method, the new 'stdin'
method is offered as an alternative by using option '--ca-via-stdin'
Discussion:
Using EasyRSA temp-files means that these files can be written to
specific places. In the case of the CA password, it is recommended
to use a RAM-Disk to write CA password temp-files to.
Using heredocs to pass data via file-descriptors, in all probability,
will write the heredoc data to a temp-file managed by the shell in use.
Thus, there are temp-files written in both methods.
The difference being that, the EasyRSA managed temp-files can be written to
specific places, while the shell managed temp-files are out of EasyRSA scope.
In conclusion, both methods are offered, however, the default remains
as EasyRSA temp-files for the CA password method.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
ERSA_UTEST_VERSION and EASYRSA_USE_PASS are only defined when the unit-tests are run.
When they are detected, force use of CA password via 'stdin'.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
When OpenSSL is built "for Windows", it does not support
password input/output via argument 'fd:N', file-descriptors.
However, OpenSSL built "for Windows" does allow use of 'stdin'.
eg: -pass:stdin (-passin/-passout)
There is one drawback; When using 'stdin' openssl cannot allow
further user input to customise the 'commonName', or any other
organisational fields used by '--dn-mode=org'. OpenSSL enforces
'-batch' when 'stdin' is used. Therefore, EasyRSA must set batch
mode, to correctly use 'stdin' to pass the CA password.
Creating CA key pair this way also requires that SSL option
'-keyout' be dropped from the create CA request command.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit d3592f1b6ea69bb93559108ac78c869308a8e2f3
Merge: ec1d428 05d0213
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu May 11 23:06:20 2023 +0100
Merge branch 'verify-cert-direct-openssl-call' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-verify-cert-direct-openssl-call
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
commit 05d0213d6dff4706d058442b6e9cddcad1124fbc
Author: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu May 11 13:35:12 2023 +0100
verify-cert: Call 'openssl' directly to capture error
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Command 'upgrade' was configured to create a second secure_session,
this is not allowed, so remove.
Minor format changes for 'show-expire' and --verbose output.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This allows a fallback to use temp-files for CA password, in the event
that file-descriptor method fails.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Until now, EasyRSA has used temp-files to store the CA password and
passed those temp-files to SSL to build a CA keypair, when building
a CA manually, with a password.
From now, EasyRSA will use an internal variable to contain the CA
password and pass the value of that variable via file-descriptors
to SSL, when building a CA keypair.
This file-descriptor method is only used when building a CA with a
password manually, when the user enters the password via keyboard.
All other build-ca methods remain unchanged.
Also, move keypair temp-files to output files or error out.
Also, minor improvements to comments and verbose messages.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Saving the name of the fully expanded Safe SSL config means that this
config file only has to be built once.
The assignment of working_safe_ssl_conf, which signifies that a Safe
SSL config has already been created, was set too late, which caused
it to be set even if the Safe SSL config had not been created.
Also, include a final check in verify_working_env() to ensure that
working_safe_ssl_conf has not been set prior to executing the issued
command, eg. build-ca.
Also, improve verbose messages and comments.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
verify_algo_params() expects errors when settings are not corrrect.
Therefore, is must not use easyrsa_openssl() meta-wrapper, which would
error out with a misleading error message.
Fixing this also ensures that the SAFE SSL config is not built prior
to EASYRSA_REQ_CN being set.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
EASYRSA_KEY_SIZE is present in the SSL config file, therefore,
it MUST always be set, regardless of EASYRSA_ALGO in use.
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
