Use x509-types 'ca' and COMMON when building a CA #526
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To sign a request, easyrsa uses 'openssl ca', which does support -extfile. To create a CA, easyrsa uses 'openssl req', which does not support -extfile. Therefore, the x509-types 'ca' and COMMON files cannot be specified using -extfile to create a CA. Instead, they must be included within the SSL config file, which 'openssl req' does support. Using the same awk script from gen_req(), with New Token '#%X509_TYPES%', the x509-types files 'ca' and COMMON are inserted into the SSL config file. Closes: #525 Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
TinCanTech
added
feedback welcome
Priority
Set env:var: EASYRSA_EXTRA_EXTS="-addext foo,a:b -addext bah,c:d -addext baz e:f,g" The value of EASYRSA_EXTRA_EXTS is passed as-is to the SSL command. Creating a CA does not allow for an arbitrary extensions file, therefore extensions must be added via the config file (#526) or via SSL Library option '-addext' (Can be specified to SSL multiple times). Option '-addext' is allowed to be specified multiple times to SSL, therefore, this string must be syntactically correct for SSL not EasyRSA. Finally, rename EASYRSA_EXTRA_EXTS to EASYRSA_CA_EXTRA_EXTS to avoid triggering EASYRSA_EXTRA_EXTS code buried inside of easyrsa_openssl(). Closes: #54 Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
TinCanTech
added a commit
that referenced
this pull request
Apr 3, 2022
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
Collaborator
Author
|
Merged in |
TinCanTech
added
testing branch
Full-Approval
Collaborator
Author
|
Also closes #54 |
TinCanTech
added
initial-approval
Full-Approval
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To sign a request, easyrsa uses 'openssl ca', which does support -extfile.
To create a CA, easyrsa uses 'openssl req', which does not support -extfile.
Therefore, the x509-types 'ca' and COMMON files cannot be specified using
-extfile to create a CA. Instead, they must be included within the SSL
config file, which 'openssl req' does support.
Using the same awk script from gen_req(), with New Token '#%X509_TYPES%',
the x509-types files 'ca' and COMMON are inserted into the SSL config file.
Closes: #525
Signed-off-by: Richard T Bonhomme tincantech@protonmail.com