Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Replace SSL calls for serial number with function ssl_cert_serial() #797

Merged
merged 3 commits into from
Dec 4, 2022
Merged

Replace SSL calls for serial number with function ssl_cert_serial() #797

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3caf0ec
Replace SSL calls for serial number with function ssl_cert_serial()
TinCanTech Dec 3, 2022
c3943ed
Replace use of $EASYRSA_OPENSSL with easyrsa_openssl()
TinCanTech Dec 3, 2022
886002b
Rename function variable
TinCanTech Dec 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
109 changes: 66 additions & 43 deletions easyrsa3/easyrsa
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ Here is the list of commands available with a short syntax reminder. Use the
revoke <file_name_base> [ cmd-opts ]
renew <file_name_base>
revoke-renewed <file_name_base> [ cmd-opts ]
rewind-renew <certificate-serial-number>
rewind-renew <certificate_serial_number>
rebuild <file_name_base> [ cmd-opts ]
gen-crl
update-db
Expand Down Expand Up @@ -195,7 +195,7 @@ cmd_help() {
;;
rewind|rewind-renew)
text="
* rewind-renew <certificate-serial-number>
* rewind-renew <certificate_serial_number>

Rewind an EasyRSA version 3.0 'style' renewed certificate.
Once 'rewind' has completed the certificate can be revoked
Expand Down Expand Up @@ -2002,10 +2002,9 @@ Unable to verify request. The file is not a valid request.
Unexpected input in file: $req_in"
fi

# get the serial number of the certificate -> serial=XXXX
cert_serial="$(easyrsa_openssl x509 -in "$crt_in" -noout -serial)"
# remove the serial= part -> we only need the XXXX part
cert_serial="${cert_serial##*=}"
# get the serial number of the certificate
ssl_cert_serial "$crt_in" cert_serial

duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"

# Set out_dir
Expand Down Expand Up @@ -2175,10 +2174,9 @@ Unable to verify request. The file is not a valid request.
Unexpected input in file: $req_in"
fi

# get the serial number of the certificate -> serial=XXXX
cert_serial="$(easyrsa_openssl x509 -in "$crt_in" -noout -serial)"
# remove the serial= part -> we only need the XXXX part
cert_serial="${cert_serial##*=}"
# get the serial number of the certificate
ssl_cert_serial "$crt_in" cert_serial

duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"

# Set out_dir
Expand Down Expand Up @@ -2403,11 +2401,9 @@ Unable to verify request. The file is not a valid request.
Unexpected input in file: $req_in"
fi

# get the serial number of the certificate -> serial=XXXX
cert_serial="$(easyrsa_openssl x509 -in "$crt_in" -noout -serial)" \
|| die "renew-revoked - Failed to retrieve certificate serial number"
# remove the serial= part -> we only need the XXXX part
cert_serial="${cert_serial##*=}"
# get the serial number of the certificate
ssl_cert_serial "$crt_in" cert_serial

duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"

# output
Expand Down Expand Up @@ -2656,10 +2652,9 @@ Unable to verify request. The file is not a valid request.
Unexpected input in file: $req_in"
fi

# get the serial number of the certificate -> serial=XXXX
cert_serial="$(easyrsa_openssl x509 -in "$crt_in" -noout -serial)"
# remove the serial= part -> we only need the XXXX part
cert_serial="${cert_serial##*=}"
# get the serial number of the certificate
ssl_cert_serial "$crt_in" cert_serial

duplicate_crt_by_serial="$EASYRSA_PKI/certs_by_serial/$cert_serial.pem"

# Set out_dir
Expand Down Expand Up @@ -3187,15 +3182,21 @@ display_san() {
shift 2

if echo "$EASYRSA_EXTRA_EXTS" | grep -q subjectAltName; then
print "$(echo "$EASYRSA_EXTRA_EXTS" | grep subjectAltName |
sed 's/^[[:space:]]*subjectAltName[[:space:]]*=[[:space:]]*//')"
# Print user defined SAN
print "$(\
echo "$EASYRSA_EXTRA_EXTS" | grep subjectAltName | \
sed 's/^[[:space:]]*subjectAltName[[:space:]]*=[[:space:]]*//'
)"

else
san="$(
x509v3san="X509v3 Subject Alternative Name:"
"$EASYRSA_OPENSSL" "$format" -in "$path" -noout -text |
sed -n "/${x509v3san}/{n;s/ //g;s/IPAddress:/IP:/g;s/RegisteredID/RID/;p;}"
)"
# Generate a SAN
san="$(
x509v3san="X509v3 Subject Alternative Name:"
easyrsa_openssl "$format" -in "$path" -noout -text | sed -n \
"/${x509v3san}/{n;s/ //g;s/IPAddress:/IP:/g;s/RegisteredID/RID/;p;}"
)"

# Print auto SAN
[ "$san" ] && print "$san"
fi
} # => display_san()
Expand All @@ -3210,7 +3211,7 @@ display_dn() {
# Display DN
name_opts="utf8,sep_multiline,space_eq,lname,align"
print "$(
"$EASYRSA_OPENSSL" "$format" -in "$path" -noout -subject \
easyrsa_openssl "$format" -in "$path" -noout -subject \
-nameopt "$name_opts"
)"

Expand All @@ -3231,13 +3232,15 @@ default_server_san() {

# Extract CN from DN
cn="$(
easyrsa_openssl req -in "$path" -noout -subject -nameopt sep_multiline |
awk -F'=' '/^ *CN=/{print $2}'
easyrsa_openssl req -in "$path" -noout -subject \
-nameopt sep_multiline |
awk -F'=' '/^ *CN=/{print $2}'
)"

# See: https://github.com/OpenVPN/easy-rsa/issues/576
# Select default SAN
if echo "$cn" | grep -E -q '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$'
if echo "$cn" | grep -q \
-E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$'
then
print "subjectAltName = IP:$cn"
else
Expand Down Expand Up @@ -3286,7 +3289,8 @@ No certificate found for the input: '$crt_in'"
Input is not a valid certificate: $crt_in"

# Test SSL out
if easyrsa_openssl verify -CAfile "$ca_crt" "$crt_in" 1>/dev/null; then
if easyrsa_openssl verify -CAfile "$ca_crt" "$crt_in" 1>/dev/null
then
notice "\
Certificate name: $file_name_base
Verfication status: GOOD"
Expand All @@ -3295,7 +3299,7 @@ Input is not a valid certificate: $crt_in"
notice "\
Certificate name: $file_name_base
Verfication status: FAILED"
# Exit with error (cmd-opt: batch), otherwise terminal msg only
# Exit with error (batch mode), otherwise term msg only
[ "$exit_with_error" ] && easyrsa_error_exit=1
# Return error for internal callers (status reports)
return 1
Expand All @@ -3306,8 +3310,7 @@ Input is not a valid certificate: $crt_in"
verify_file() {
format="$1"
path="$2"
easyrsa_openssl "$format" -in "$path" -noout 2>/dev/null || return 1
return 0
easyrsa_openssl "$format" -in "$path" -noout 2>/dev/null
} # => verify_file()

# show-* command backend
Expand Down Expand Up @@ -3694,12 +3697,33 @@ db_date_to_ff_date() {
ff_date="${yy}-${mm}-${dd} ${HH}:${MM}:${SS}${TZ}"
} # => build_ff_date_string()

# get the serial number of the certificate -> serial=XXXX
ssl_cert_serial() {
[ "$#" = 2 ] || die "ssl_cert_serial - invalid input"
[ -f "$1" ] || die "ssl_cert_serial - missing cert"
verify_file x509 "$1" || die "ssl_cert_serial - invalid cert"

fn_ssl_out="$(
easyrsa_openssl x509 -in "$1" -noout -serial
)" || die "ssl_cert_serial - failed to get serial"
shift

# remove the serial= part -> we only need the XXXX part
fn_ssl_out="${fn_ssl_out##*=}"

unset -v "$@"
set_var "$@" "$fn_ssl_out" || \
die "ssl_cert_serial - failed to set variable '$@'"
unset -v fn_ssl_out
} # => ssl_cert_serial()

# Get certificate start date
ssl_cert_not_before_date() {
[ "$1" ] || die "ssl_cert_not_before_date - Invalid input"
unset -v ssl_out cert_not_before_date
ssl_out="$("$EASYRSA_OPENSSL" x509 -in "$1" -noout -startdate)" \
|| die "ssl_cert_not_before_date - ssl_out: $ssl_out"
ssl_out="$(
easyrsa_openssl x509 -in "$1" -noout -startdate
)" || die "ssl_cert_not_before_date - ssl_out: $ssl_out"
# 'cert_not_before_date' is *not* used, at this time..
# disable #shellcheck disable=SC2034 # Prefer to keep the warning
cert_not_before_date="${ssl_out#*=}"
Expand All @@ -3710,8 +3734,9 @@ ssl_cert_not_before_date() {
ssl_cert_not_after_date() {
[ "$1" ] || die "ssl_cert_not_after_date - Invalid input"
unset -v ssl_out cert_not_after_date
ssl_out="$("$EASYRSA_OPENSSL" x509 -in "$1" -noout -enddate)" \
|| die "ssl_cert_not_after_date - ssl_out: $ssl_out"
ssl_out="$(
easyrsa_openssl x509 -in "$1" -noout -enddate
)" || die "ssl_cert_not_after_date - ssl_out: $ssl_out"
cert_not_after_date="${ssl_out#*=}"
unset -v ssl_out
} # => ssl_cert_not_after_date()
Expand Down Expand Up @@ -3795,8 +3820,7 @@ expire_status() {
if [ -e "$cert_issued" ]; then

# get the serial number of the certificate
cert_serial="$(easyrsa_openssl x509 -in "$cert_issued" -noout -serial)"
cert_serial="${cert_serial##*=}"
ssl_cert_serial "$cert_issued" cert_serial

# db serial must match certificate serial, otherwise this
# is a renewed cert which has been replaced by an issued cert
Expand Down Expand Up @@ -3855,7 +3879,7 @@ revoke_status() {
# Only ONE renewed cert with unique CN can exist in the renewed folder
renew_status() {
# Does a Renewed cert exist ?
# files in issued are CommonName, files by-serial are SerialNumber
# files in issued are CommonName, files by serial are SerialNumber
unset -v cert_file_in cert_is_issued cert_is_serial renew_is_old
# Find renewed/issued/CN
if [ -e "$cert_r_issued" ]; then
Expand All @@ -3876,8 +3900,7 @@ renew_status() {
# If a renewed cert exists
if [ "$cert_file_in" ]; then
# get the serial number of the certificate
cert_serial="$(easyrsa_openssl x509 -in "$cert_file_in" -noout -serial)"
cert_serial="${cert_serial##*=}"
ssl_cert_serial "$cert_file_in" cert_serial

# db serial must match certificate serial, otherwise this
# is an issued cert that replaces a renewed cert
Expand Down