2bc89f7658
Option '--renew-days=#', variable $EASYRSA_CERT_RENEW was used to enforce a "grace" period, *outside of which* 'renew' was prohibited. Default: 30days. This prohibition is no longer enforced: * https://github.com/OpenVPN/easy-rsa/issues/593 Option '--renew-days=#' now represents the cut-off date for EasyRSA status report 'show-expire'. This report *only* lists those certificates which will expire within the given $EASYRSA_CERT_RENEW number of days 'from now'. This also effects the command 'renewable'. (Only supports GNU 'date') Updates to 'help options'. (1) Official notice of "intention to deprecate" option: '--req-cn' EasyRSA has *never* supported '--req-cn'. For "type" server/client 'Build-$type-full' AlWAYS explicitly sets variable EASYRSA_REQ_CN to $2 from the command line. Always over-riding the option. 'gen-req' explicitly sets 'EASYRSA_REQ_CN="$1"'. Always over-riding .. 'sign-req' explicitly sets 'crt_out="$EASYRSA_PKI/issued/$2.crt"' .. ditto. 'build-ca' requires specific code review to understand. Labeled as: "May have tried but gave up.." This is *only* a notice of "intention to deprecate". The main goal of the option '--req-cn' is to achieve a disconnect between certificate 'commonName' verses the 'file-name' of the certificate. Eg: file-name: mmjd0101.crt | commonName: "mass-murderer John Doe (#0101)" There is "merit" to this functionality but then .. EasyRSA is Free-OSS. "If You need this functionality then You should help provide it." Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Overview
easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's terms, this means to create a root certificate authority, and request and sign certificates, including intermediate CAs and certificate revocation lists (CRL).
Downloads
If you are looking for release downloads, please see the releases section on GitHub. Releases are also available as source checkouts using named tags.
Documentation
For 3.x project documentation and usage, see the README.quickstart.md file or the more detailed docs under the doc/ directory. The .md files are in Markdown format and can be converted to html files as desired for release packages, or read as-is in plaintext.
Getting help using easy-rsa
Currently, Easy-RSA development co-exists with OpenVPN even though they are separate projects. The following resources are good places as of this writing to seek help using Easy-RSA:
The openvpn-users mailing list is a good place to post usage or help questions.
You can also try libera.chat IRC network, in channels #openvpn for general support or #easyrsa for development discussion.
Branch structure
The easy-rsa master branch is currently tracking development for the 3.x release cycle. Please note that, at any given time, master may be broken. Feel free to create issues against master, but have patience when using the master branch. It is recommended to use a release, and priority will be given to bugs identified in the most recent release.
The prior 2.x and 1.x versions are available as release branches for tracking and possible back-porting of relevant fixes. Branch layout is:
master <- 3.1, at present
v3.x.x pre-release branches, used for staging branches
release/3.0 v3.0.x bugfix/security/openssl updates
release/2.x
release/1.x
LICENSING info for 3.x is in the COPYING.md file
Code style, standards
We are attempting to adhere to the POSIX standard, which can be found here: