Skip to content

Commit

Permalink
Merge branch 'always-use-easyrsa_openssl' of ssh://github.com/TinCanT…
Browse files Browse the repository at this point in the history 
…ech/easy-rsa into TinCanTech-always-use-easyrsa_openssl

PLUS: Minor changes to error meesage output only, no functional changes.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
  • Loading branch information
@TinCanTech
TinCanTech committed Dec 4, 2022
2 parents ec56603 + 886002b commit 4be21f8
Showing 1 changed file with 66 additions and 43 deletions.
109 changes: 66 additions & 43 deletions easyrsa3/easyrsa
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ Here is the list of commands available with a short syntax reminder. Use the
revoke <file_name_base> [ cmd-opts ]
renew <file_name_base>
revoke-renewed <file_name_base> [ cmd-opts ]
rewind-renew <certificate-serial-number>
rewind-renew <certificate_serial_number>
rebuild <file_name_base> [ cmd-opts ]
gen-crl
update-db
Expand Down Expand Up @@ -195,7 +195,7 @@ cmd_help() {
;;
rewind|rewind-renew)
text="
* rewind-renew <certificate-serial-number>
* rewind-renew <certificate_serial_number>

Rewind an EasyRSA version 3.0 'style' renewed certificate.
Once 'rewind' has completed the certificate can be revoked
Expand Down Expand Up @@ -2002,10 +2002,9 @@ Unable to verify request. The file is not a valid request.
Unexpected input in file: $req_in"
fi

# get the serial number of the certificate -> serial=XXXX
cert_serial="$(easyrsa_openssl x509 -in "$crt_in" -noout -serial)"
# remove the serial= part -> we only need the XXXX part
cert_serial="${cert_serial##*=}"
# get the serial number of the certificate
ssl_cert_serial "$crt_in" cert_serial

duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"

# Set out_dir
Expand Down Expand Up @@ -2175,10 +2174,9 @@ Unable to verify request. The file is not a valid request.
Unexpected input in file: $req_in"
fi

# get the serial number of the certificate -> serial=XXXX
cert_serial="$(easyrsa_openssl x509 -in "$crt_in" -noout -serial)"
# remove the serial= part -> we only need the XXXX part
cert_serial="${cert_serial##*=}"
# get the serial number of the certificate
ssl_cert_serial "$crt_in" cert_serial

duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"

# Set out_dir
Expand Down Expand Up @@ -2403,11 +2401,9 @@ Unable to verify request. The file is not a valid request.
Unexpected input in file: $req_in"
fi

# get the serial number of the certificate -> serial=XXXX
cert_serial="$(easyrsa_openssl x509 -in "$crt_in" -noout -serial)" \
|| die "renew-revoked - Failed to retrieve certificate serial number"
# remove the serial= part -> we only need the XXXX part
cert_serial="${cert_serial##*=}"
# get the serial number of the certificate
ssl_cert_serial "$crt_in" cert_serial

duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"

# output
Expand Down Expand Up @@ -2656,10 +2652,9 @@ Unable to verify request. The file is not a valid request.
Unexpected input in file: $req_in"
fi

# get the serial number of the certificate -> serial=XXXX
cert_serial="$(easyrsa_openssl x509 -in "$crt_in" -noout -serial)"
# remove the serial= part -> we only need the XXXX part
cert_serial="${cert_serial##*=}"
# get the serial number of the certificate
ssl_cert_serial "$crt_in" cert_serial

duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"

# Set out_dir
Expand Down Expand Up @@ -3187,15 +3182,21 @@ display_san() {
shift 2

if echo "$EASYRSA_EXTRA_EXTS" | grep -q subjectAltName; then
print "$(echo "$EASYRSA_EXTRA_EXTS" | grep subjectAltName |
sed 's/^[[:space:]]*subjectAltName[[:space:]]*=[[:space:]]*//')"
# Print user defined SAN
print "$(\
echo "$EASYRSA_EXTRA_EXTS" | grep subjectAltName | \
sed 's/^[[:space:]]*subjectAltName[[:space:]]*=[[:space:]]*//'
)"

else
san="$(
x509v3san="X509v3 Subject Alternative Name:"
"$EASYRSA_OPENSSL" "$format" -in "$path" -noout -text |
sed -n "/${x509v3san}/{n;s/ //g;s/IPAddress:/IP:/g;s/RegisteredID/RID/;p;}"
)"
# Generate a SAN
san="$(
x509v3san="X509v3 Subject Alternative Name:"
easyrsa_openssl "$format" -in "$path" -noout -text | sed -n \
"/${x509v3san}/{n;s/ //g;s/IPAddress:/IP:/g;s/RegisteredID/RID/;p;}"
)"

# Print auto SAN
[ "$san" ] && print "$san"
fi
} # => display_san()
Expand All @@ -3210,7 +3211,7 @@ display_dn() {
# Display DN
name_opts="utf8,sep_multiline,space_eq,lname,align"
print "$(
"$EASYRSA_OPENSSL" "$format" -in "$path" -noout -subject \
easyrsa_openssl "$format" -in "$path" -noout -subject \
-nameopt "$name_opts"
)"

Expand All @@ -3231,13 +3232,15 @@ default_server_san() {

# Extract CN from DN
cn="$(
easyrsa_openssl req -in "$path" -noout -subject -nameopt sep_multiline |
awk -F'=' '/^ *CN=/{print $2}'
easyrsa_openssl req -in "$path" -noout -subject \
-nameopt sep_multiline |
awk -F'=' '/^ *CN=/{print $2}'
)"

# See: https://github.com/OpenVPN/easy-rsa/issues/576
# Select default SAN
if echo "$cn" | grep -E -q '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$'
if echo "$cn" | grep -q \
-E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$'
then
print "subjectAltName = IP:$cn"
else
Expand Down Expand Up @@ -3286,7 +3289,8 @@ No certificate found for the input: '$crt_in'"
Input is not a valid certificate: $crt_in"

# Test SSL out
if easyrsa_openssl verify -CAfile "$ca_crt" "$crt_in" 1>/dev/null; then
if easyrsa_openssl verify -CAfile "$ca_crt" "$crt_in" 1>/dev/null
then
notice "\
Certificate name: $file_name_base
Verfication status: GOOD"
Expand All @@ -3295,7 +3299,7 @@ Input is not a valid certificate: $crt_in"
notice "\
Certificate name: $file_name_base
Verfication status: FAILED"
# Exit with error (cmd-opt: batch), otherwise terminal msg only
# Exit with error (batch mode), otherwise term msg only
[ "$exit_with_error" ] && easyrsa_error_exit=1
# Return error for internal callers (status reports)
return 1
Expand All @@ -3306,8 +3310,7 @@ Input is not a valid certificate: $crt_in"
verify_file() {
format="$1"
path="$2"
easyrsa_openssl "$format" -in "$path" -noout 2>/dev/null || return 1
return 0
easyrsa_openssl "$format" -in "$path" -noout 2>/dev/null
} # => verify_file()

# show-* command backend
Expand Down Expand Up @@ -3694,12 +3697,33 @@ db_date_to_ff_date() {
ff_date="${yy}-${mm}-${dd} ${HH}:${MM}:${SS}${TZ}"
} # => build_ff_date_string()

# get the serial number of the certificate -> serial=XXXX
ssl_cert_serial() {
[ "$#" = 2 ] || die "ssl_cert_serial - invalid input"
[ -f "$1" ] || die "ssl_cert_serial - missing cert"
verify_file x509 "$1" || die "ssl_cert_serial - invalid cert"

fn_ssl_out="$(
easyrsa_openssl x509 -in "$1" -noout -serial
)" || die "ssl_cert_serial - failed to get serial"
shift

# remove the serial= part -> we only need the XXXX part
fn_ssl_out="${fn_ssl_out##*=}"

unset -v "$@"
set_var "$@" "$fn_ssl_out" || \
die "ssl_cert_serial - failed to set variable '$*'"
unset -v fn_ssl_out
} # => ssl_cert_serial()

# Get certificate start date
ssl_cert_not_before_date() {
[ "$1" ] || die "ssl_cert_not_before_date - Invalid input"
unset -v ssl_out cert_not_before_date
ssl_out="$("$EASYRSA_OPENSSL" x509 -in "$1" -noout -startdate)" \
|| die "ssl_cert_not_before_date - ssl_out: $ssl_out"
ssl_out="$(
easyrsa_openssl x509 -in "$1" -noout -startdate
)" || die "ssl_cert_not_before_date - ssl_out error"
# 'cert_not_before_date' is *not* used, at this time..
# disable #shellcheck disable=SC2034 # Prefer to keep the warning
cert_not_before_date="${ssl_out#*=}"
Expand All @@ -3710,8 +3734,9 @@ ssl_cert_not_before_date() {
ssl_cert_not_after_date() {
[ "$1" ] || die "ssl_cert_not_after_date - Invalid input"
unset -v ssl_out cert_not_after_date
ssl_out="$("$EASYRSA_OPENSSL" x509 -in "$1" -noout -enddate)" \
|| die "ssl_cert_not_after_date - ssl_out: $ssl_out"
ssl_out="$(
easyrsa_openssl x509 -in "$1" -noout -enddate
)" || die "ssl_cert_not_after_date - ssl_out error"
cert_not_after_date="${ssl_out#*=}"
unset -v ssl_out
} # => ssl_cert_not_after_date()
Expand Down Expand Up @@ -3795,8 +3820,7 @@ expire_status() {
if [ -e "$cert_issued" ]; then

# get the serial number of the certificate
cert_serial="$(easyrsa_openssl x509 -in "$cert_issued" -noout -serial)"
cert_serial="${cert_serial##*=}"
ssl_cert_serial "$cert_issued" cert_serial

# db serial must match certificate serial, otherwise this
# is a renewed cert which has been replaced by an issued cert
Expand Down Expand Up @@ -3855,7 +3879,7 @@ revoke_status() {
# Only ONE renewed cert with unique CN can exist in the renewed folder
renew_status() {
# Does a Renewed cert exist ?
# files in issued are CommonName, files by-serial are SerialNumber
# files in issued are CommonName, files by serial are SerialNumber
unset -v cert_file_in cert_is_issued cert_is_serial renew_is_old
# Find renewed/issued/CN
if [ -e "$cert_r_issued" ]; then
Expand All @@ -3876,8 +3900,7 @@ renew_status() {
# If a renewed cert exists
if [ "$cert_file_in" ]; then
# get the serial number of the certificate
cert_serial="$(easyrsa_openssl x509 -in "$cert_file_in" -noout -serial)"
cert_serial="${cert_serial##*=}"
ssl_cert_serial "$cert_file_in" cert_serial

# db serial must match certificate serial, otherwise this
# is an issued cert that replaces a renewed cert
Expand Down

0 comments on commit 4be21f8

Please sign in to comment.