Subversion Repositories configs

#!/bin/sh

# Easy-RSA 3 -- A Shell-based CA Utility

#

# Copyright (C) 2018 by the Open-Source OpenVPN development community.

# A full list of contributors can be found in the ChangeLog.

#

# This code released under version 2 of the GNU GPL; see COPYING and the

# Licensing/ directory of this project for full licensing details.

# Help/usage output to stdout

usage() {

	# command help:

	print "

Easy-RSA 3 usage and overview

USAGE: easyrsa [options] COMMAND [command-options]

A list of commands is shown below. To get detailed usage and help for a

command, run:

  ./easyrsa help COMMAND

For a listing of options that can be supplied before the command, use:

  ./easyrsa help options

Here is the list of commands available with a short syntax reminder. Use the

'help' command above to get full usage details.

  init-pki

  build-ca [ cmd-opts ]

  gen-dh

  gen-req <filename_base> [ cmd-opts ]

  sign-req <type> <filename_base>

  build-client-full <filename_base> [ cmd-opts ]

  build-server-full <filename_base> [ cmd-opts ]

  revoke <filename_base> [cmd-opts]

  renew <filename_base> [cmd-opts]

  build-serverClient-full <filename_base> [ cmd-opts ]

  gen-crl

  update-db

  show-req <filename_base> [ cmd-opts ]

  show-cert <filename_base> [ cmd-opts ]

  show-ca [ cmd-opts ]

  import-req <request_file_path> <short_basename>

  export-p7 <filename_base> [ cmd-opts ]

  export-p12 <filename_base> [ cmd-opts ]

  set-rsa-pass <filename_base> [ cmd-opts ]

  set-ec-pass <filename_base> [ cmd-opts ]

  upgrade <type>

"

	# collect/show dir status:

	err_source="Not defined: vars autodetect failed and no value provided"

	work_dir="${EASYRSA:-$err_source}"

	pki_dir="${EASYRSA_PKI:-$err_source}"

	print "\

DIRECTORY STATUS (commands would take effect on these locations)

  EASYRSA: $work_dir

      PKI: $pki_dir

"

} # => usage()

# Detailed command help

# When called with no args, calls usage(), otherwise shows help for a command

cmd_help() {

	text=""

	opts=""

	case "$1" in

		init-pki|clean-all) text="

  init-pki [ cmd-opts ]

      Removes & re-initializes the PKI dir for a clean PKI" ;;

		build-ca) text="

  build-ca [ cmd-opts ]

      Creates a new CA"

      			opts="

        nopass  - do not encrypt the CA key (default is encrypted)

        subca   - create an intermediate CA keypair and request (default is a root CA)

        intca   - alias to the above" ;;

		gen-dh) text="

  gen-dh

      Generates DH (Diffie-Hellman) parameters" ;;

		gen-req) text="

  gen-req <filename_base> [ cmd-opts ]

      Generate a standalone keypair and request (CSR)

      This request is suitable for sending to a remote CA for signing."

      			opts="

        nopass  - do not encrypt the private key (default is encrypted)" ;;

		sign|sign-req) text="

  sign-req <type> <filename_base>

      Sign a certificate request of the defined type. <type> must be a known

      type such as 'client', 'server', 'serverClient', or 'ca' (or a user-added type.)

      This request file must exist in the reqs/ dir and have a .req file

      extension. See import-req below for importing reqs from other sources." ;;

		build|build-client-full|build-server-full|build-serverClient-full) text="

  build-client-full <filename_base> [ cmd-opts ]

  build-server-full <filename_base> [ cmd-opts ]

  build-serverClient-full <filename_base> [ cmd-opts ]

      Generate a keypair and sign locally for a client and/or server

      This mode uses the <filename_base> as the X509 CN."

			opts="

        nopass  - do not encrypt the private key (default is encrypted)

        inline  - create an inline credentials file for this node" ;;

		revoke) text="

  revoke <filename_base> [reason]

      Revoke a certificate specified by the filename_base, with an optional

      revocation reason that is one of:

        unspecified

        keyCompromise

        CACompromise

        affiliationChanged

        superseded

        cessationOfOperation

        certificateHold";;

		renew) text="

  renew <filename_base> [ cmd-opts ]

      Renew a certificate specified by the filename_base"

				opts="

        nopass  - do not encrypt the private key (default is encrypted)" ;;

		gen-crl) text="

  gen-crl

      Generate a CRL" ;;

		update-db) text="

  update-db

      Update the index.txt database

      This command will use the system time to update the status of issued

      certificates." ;;

      		show-req|show-cert) text="

  show-req  <filename_base> [ cmd-opts ]

  show-cert <filename_base> [ cmd-opts ]

      Shows details of the req or cert referenced by filename_base

      Human-readable output is shown, including any requested cert options when

      showing a request."

      			opts="

          full   - show full req/cert info, including pubkey/sig data" ;;

		show-ca) text="

  show-ca [ cmd-opts ]

      Shows details of the CA cert

      Human-readable output is shown."

			opts="

          full   - show full cert info, including pubkey/sig data" ;;

		import-req) text="

  import-req <request_file_path> <short_basename>

      Import a certificate request from a file

      This will copy the specified file into the reqs/ dir in

      preparation for signing.

      The <short_basename> is the filename base to create.

      Example usage:

        import-req /some/where/bob_request.req bob" ;;

		export-p12) text="

  export-p12 <filename_base> [ cmd-opts ]

      Export a PKCS#12 file with the keypair specified by <filename_base>"

			opts="

        noca  - do not include the ca.crt file in the PKCS12 output

        nokey - do not include the private key in the PKCS12 output" ;;

		export-p7) text="

  export-p7 <filename_base> [ cmd-opts ]

      Export a PKCS#7 file with the pubkey specified by <filename_base>"

			opts="

        noca  - do not include the ca.crt file in the PKCS7 output" ;;

		set-rsa-pass|set-ec-pass) text="

  set-rsa-pass <filename_base> [ cmd-opts ]

  set-ec-pass <filename_base> [ cmd-opts ]

      Set a new passphrase on an RSA or EC key for the listed <filename_base>."

                        opts="

        nopass - use no password and leave the key unencrypted

        file   - (advanced) treat the file as a raw path, not a short-name" ;;

		upgrade) text="

  upgrade <type>

      Upgrade EasyRSA PKI and/or CA. <type> must be one of:

        pki - Upgrade EasyRSA v2.x PKI to EasyRSA v3.x PKI (includes CA below)

        ca  - Upgrade EasyRSA v3.0.5 CA or older to EasyRSA v3.0.6 CA or later." ;;

		altname|subjectaltname|san) text="

  --subject-alt-name=SAN_FORMAT_STRING

      This global option adds a subjectAltName to the request or issued

      certificate. It MUST be in a valid format accepted by openssl or

      req/cert generation will fail. Note that including multiple such names

      requires them to be comma-separated; further invocations of this

      option will REPLACE the value.

      Examples of the SAN_FORMAT_STRING shown below:

        DNS:alternate.example.net

        DNS:primary.example.net,DNS:alternate.example.net

        IP:203.0.113.29

        email:alternate@example.net" ;;

		options)

			opt_usage ;;

		"")

			usage ;;

		*) text="

  Unknown command: '$1' (try without commands for a list of commands)" ;;

	esac

	# display the help text

	print "$text"

	[ -n "$opts" ] && print "

      cmd-opts is an optional set of command options from this list:

$opts"

} # => cmd_help()

# Options usage

opt_usage() {

	print "

Easy-RSA Global Option Flags

The following options may be provided before the command. Options specified

at runtime override env-vars and any 'vars' file in use. Unless noted,

non-empty values to options are mandatory.

General options:

--batch         : set automatic (no-prompts when possible) mode

--passin=ARG    : set -passin ARG for openssl

--passout=ARG   : set -passout ARG for openssl

--pki-dir=DIR   : declares the PKI directory

--vars=FILE     : define a specific 'vars' file to use for Easy-RSA config

Certificate & Request options: (these impact cert/req field values)

--days=#        : sets the signing validity to the specified number of days

--digest=ALG    : digest to use in the requests & certificates

--dn-mode=MODE  : DN mode to use (cn_only or org)

--keysize=#     : size in bits of keypair to generate

--req-cn=NAME   : default CN to use

--subca-len=#   : path length of signed intermediate CA certs; must be >= 0 if used

--subject-alt-name : Add a subjectAltName. For more info and syntax, see:

                     ./easyrsa help altname

--use-algo=ALG  : crypto alg to use: choose rsa (default) or ec

--curve=NAME    : for elliptic curve, sets the named curve to use

--copy-ext      : Copy included request X509 extensions (namely subjAltName

Organizational DN options: (only used with the 'org' DN mode)

  (values may be blank for org DN options)

--req-c=CC        : country code (2-letters)

--req-st=NAME     : State/Province

--req-city=NAME   : City/Locality

--req-org=NAME    : Organization

--req-email=NAME  : Email addresses

--req-ou=NAME     : Organizational Unit

Deprecated features:

--ns-cert=YESNO       : yes or no to including deprecated NS extensions

--ns-comment=COMMENT  : NS comment to include (value may be blank)

"

} # => opt_usage()

# Wrapper around printf - clobber print since it's not POSIX anyway

# shellcheck disable=SC1117

print() { printf "%s\n" "$*"; }

# Exit fatally with a message to stderr

# present even with EASYRSA_BATCH as these are fatal problems

die() {

	print "

Easy-RSA error:

$1" 1>&2

	exit "${2:-1}"

} # => die()

# non-fatal warning output

warn() {

	[ ! "$EASYRSA_BATCH" ] && \

		print "

$1" 1>&2

} # => warn()

# informational notices to stdout

notice() {

	[ ! "$EASYRSA_BATCH" ] && \

		print "

$1"

} # => notice()

# yes/no case-insensitive match (operates on stdin pipe)

# Returns 0 when input contains yes, 1 for no, 2 for no match

# If both strings are present, returns 1; first matching line returns.

awk_yesno() {

	#shellcheck disable=SC2016

	awkscript='

BEGIN {IGNORECASE=1; r=2}

{       if(match($0,"no")) {r=1; exit}

        if(match($0,"yes")) {r=0; exit}

} END {exit r}'

	awk "$awkscript"

} # => awk_yesno()

# intent confirmation helper func

# returns without prompting in EASYRSA_BATCH

confirm() {

	[ "$EASYRSA_BATCH" ] && return

	prompt="$1"

	value="$2"

	msg="$3"

	input=""

	print "

$msg

Type the word '$value' to continue, or any other input to abort."

	printf %s "  $prompt"

	#shellcheck disable=SC2162

	read input

	[ "$input" = "$value" ] && return

	notice "Aborting without confirmation."

	exit 9

} # => confirm()

# mktemp wrapper

easyrsa_mktemp() {

	[ -n "$EASYRSA_TEMP_DIR_session" ] || die "EASYRSA_TEMP_DIR_session not initialized!"

	[ -d "$EASYRSA_TEMP_DIR_session" ] || mkdir -p "$EASYRSA_TEMP_DIR_session" ||

	       die "Could not create temporary directory '$EASYRSA_TEMP_DIR_session'. Permission or concurrency problem?"

	[ -d "$EASYRSA_TEMP_DIR_session" ] || die "Temporary directory '$EASYRSA_TEMP_DIR_session' does not exist"

	template="$EASYRSA_TEMP_DIR_session/tmp.XXXXXX"

	tempfile=$(mktemp "$template") || return

	# win32 mktemp shipped by easyrsa returns template as file!

	if [ "$template" = "$tempfile" ]; then

		# but win32 mktemp -d does work

		# but win32 mktemp -u does not work

		tempfile=$(mktemp -du "$tempfile") || return

		printf "" > "$tempfile" || return

	fi

	echo "$tempfile"

} # => easyrsa_mktemp

# remove temp files and do terminal cleanups

cleanup() {

	[ -z "$EASYRSA_TEMP_DIR_session" ] || rm -rf "$EASYRSA_TEMP_DIR_session"

	# shellcheck disable=SC2039

	(stty echo 2>/dev/null) || { (set -o echo 2>/dev/null) && set -o echo; }

	echo "" # just to get a clean line

} # => cleanup()

easyrsa_openssl() {

	openssl_command=$1; shift

	case $openssl_command in

		makesafeconf) has_config=true;;

		ca|req|srp|ts) has_config=true;;

		*) has_config=false;;

	esac

	if ! $has_config; then

		"$EASYRSA_OPENSSL" "$openssl_command" "$@"

		return

	fi

	easyrsa_openssl_conf=$(easyrsa_mktemp) || die "Failed to create temporary file"

	easyrsa_extra_exts=

	if [ -n "$EASYRSA_EXTRA_EXTS" ]; then

		easyrsa_extra_exts=$(easyrsa_mktemp) || die "Failed to create temporary file"

		cat >"$easyrsa_extra_exts" <<-EOF

			req_extensions = req_extra

			[ req_extra ]

			$EASYRSA_EXTRA_EXTS

		EOF

	fi

	# Make LibreSSL safe config file from OpenSSL config file

	sed \

		-e "s\`ENV::EASYRSA\`EASYRSA\`g" \

		-e "s\`\$dir\`$EASYRSA_PKI\`g" \

		-e "s\`\$EASYRSA_PKI\`$EASYRSA_PKI\`g" \

		-e "s\`\$EASYRSA_CERT_EXPIRE\`$EASYRSA_CERT_EXPIRE\`g" \

		-e "s\`\$EASYRSA_CRL_DAYS\`$EASYRSA_CRL_DAYS\`g" \

		-e "s\`\$EASYRSA_DIGEST\`$EASYRSA_DIGEST\`g" \

		-e "s\`\$EASYRSA_KEY_SIZE\`$EASYRSA_KEY_SIZE\`g" \

		-e "s\`\$EASYRSA_DIGEST\`$EASYRSA_DIGEST\`g" \

		-e "s\`\$EASYRSA_DN\`$EASYRSA_DN\`g" \

		-e "s\`\$EASYRSA_REQ_COUNTRY\`$EASYRSA_REQ_COUNTRY\`g" \

		-e "s\`\$EASYRSA_REQ_PROVINCE\`$EASYRSA_REQ_PROVINCE\`g" \

		-e "s\`\$EASYRSA_REQ_CITY\`$EASYRSA_REQ_CITY\`g" \

		-e "s\`\$EASYRSA_REQ_ORG\`$EASYRSA_REQ_ORG\`g" \

		-e "s\`\$EASYRSA_REQ_OU\`$EASYRSA_REQ_OU\`g" \

		-e "s\`\$EASYRSA_REQ_CN\`$EASYRSA_REQ_CN\`g" \

		-e "s\`\$EASYRSA_REQ_EMAIL\`$EASYRSA_REQ_EMAIL\`g" \

		${EASYRSA_EXTRA_EXTS:+-e "/^#%EXTRA_EXTS%/r $easyrsa_extra_exts"} \

		"$EASYRSA_SSL_CONF" > "$easyrsa_openssl_conf" ||

		die "Failed to update $easyrsa_openssl_conf"

	if [ "$openssl_command" = "makesafeconf" ]; then

		cp "$easyrsa_openssl_conf" "$EASYRSA_SAFE_CONF"

		err=$?

	else

		"$EASYRSA_OPENSSL" "$openssl_command" -config "$easyrsa_openssl_conf" "$@"

		err=$?

	fi

	rm -f "$easyrsa_openssl_conf"

	rm -f "$easyrsa_extra_exts"

	return $err

} # => easyrsa_openssl

vars_source_check() {

	# Check for defined EASYRSA_PKI

	[ -n "$EASYRSA_PKI" ] || die "\

EASYRSA_PKI env-var undefined"

} # => vars_source_check()

# Verify supplied curve exists and generate curve file if needed

verify_curve_ec() {

	if ! "$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" > /dev/null; then

		die "\

Curve $EASYRSA_CURVE not found. Run openssl ecparam -list_curves to show a

list of supported curves."

	fi

	# Check that the ecparams dir exists

	[ -d "$EASYRSA_EC_DIR" ] || mkdir "$EASYRSA_EC_DIR" || die "\

Failed creating ecparams dir (permissions?) at:

$EASYRSA_EC_DIR"

	# Check that the required ecparams file exists

	out="$EASYRSA_EC_DIR/${EASYRSA_CURVE}.pem"

	[ -f "$out" ] && return 0

	"$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" -out "$out" || die "\

Failed to generate ecparam file (permissions?) when writing to:

$out"

	# Explicitly return success for caller

	return 0

}

# Verify if Edward Curve exists

verify_curve_ed() {

	if [ "ed25519" = "$EASYRSA_CURVE" ] && "$EASYRSA_OPENSSL" genpkey -algorithm ED25519 > /dev/null; then

		return 0

	elif [ "ed448" = "$EASYRSA_CURVE" ] && "$EASYRSA_OPENSSL" genpkey -algorithm ED448 > /dev/null; then

		return 0

	fi

		die "Curve $EASYRSA_CURVE not found."

}

verify_ssl_lib () {

	# Verify EASYRSA_OPENSSL command gives expected output

	if [ -z "$EASYRSA_SSL_OK" ]; then

		val="$("$EASYRSA_OPENSSL" version)"

		case "${val%% *}" in

			OpenSSL|LibreSSL)

				print "\

Using SSL: $EASYRSA_OPENSSL $("$EASYRSA_OPENSSL" version)" ;;

			*) die "\

Missing or invalid OpenSSL

Expected to find openssl command at: $EASYRSA_OPENSSL" ;;

		esac

	fi

	EASYRSA_SSL_OK=1

	# Verify EASYRSA_SSL_CONF file exists

	[ -f "$EASYRSA_SSL_CONF" ] || die "\

The OpenSSL config file cannot be found.

Expected location: $EASYRSA_SSL_CONF"

} # => verify_ssl_lib ()

# Basic sanity-check of PKI init and complain if missing

verify_pki_init() {

	help_note="Run easyrsa without commands for usage and command help."

	# check that the pki dir exists

	vars_source_check

	[ -d "$EASYRSA_PKI" ] || die "\

EASYRSA_PKI does not exist (perhaps you need to run init-pki)?

Expected to find the EASYRSA_PKI at: $EASYRSA_PKI

$help_note"

	# verify expected dirs present:

	for i in private reqs; do

		[ -d "$EASYRSA_PKI/$i" ] || die "\

Missing expected directory: $i (perhaps you need to run init-pki?)

$help_note"

	done

	# verify ssl lib

	verify_ssl_lib

} # => verify_pki_init()

# Verify core CA files present

verify_ca_init() {

	help_note="Run without commands for usage and command help."

	# First check the PKI has been initialized

	verify_pki_init

	# Verify expected files are present. Allow files to be regular files

	# (or symlinks), but also pipes, for flexibility with ca.key

	for i in serial index.txt index.txt.attr ca.crt private/ca.key; do

		if [ ! -f "$EASYRSA_PKI/$i" ] && [ ! -p "$EASYRSA_PKI/$i" ]; then

			[ "$1" = "test" ] && return 1

			die "\

Missing expected CA file: $i (perhaps you need to run build-ca?)

$help_note"

		fi

	done

	# When operating in 'test' mode, return success.

	# test callers don't care about CA-specific dir structure

	[ "$1" = "test" ] && return 0

	# verify expected CA-specific dirs:

	for i in issued certs_by_serial

	do

		[ -d "$EASYRSA_PKI/$i" ] || die "\

Missing expected CA dir: $i (perhaps you need to run build-ca?)

$help_note"

	done

	# explicitly return success for callers

	return 0

} # => verify_ca_init()

# init-pki backend:

init_pki() {

	# If EASYRSA_PKI exists, confirm before we rm -rf (skiped with EASYRSA_BATCH)

	if [ -e "$EASYRSA_PKI" ]; then

		confirm "Confirm removal: " "yes" "

WARNING!!!

You are about to remove the EASYRSA_PKI at: $EASYRSA_PKI

and initialize a fresh PKI here."

		# now remove it:

		rm -rf "$EASYRSA_PKI" || die "Removal of PKI dir failed. Check/correct errors above"

	fi

	# new dirs:

	for i in private reqs; do

		mkdir -p "$EASYRSA_PKI/$i" || die "Failed to create PKI file structure (permissions?)"

	done

	# Create $EASYRSA_SAFE_CONF ($OPENSSL_CONF) prevents bogus warnings (especially useful on win32)

	if [ ! -f "$EASYRSA_SSL_CONF" ] && [ -f "$EASYRSA/openssl-easyrsa.cnf" ];

	then

		cp "$EASYRSA/openssl-easyrsa.cnf" "$EASYRSA_SSL_CONF"

		easyrsa_openssl makesafeconf

	fi

	notice "\

init-pki complete; you may now create a CA or requests.

Your newly created PKI dir is: $EASYRSA_PKI

"

	return 0

} # => init_pki()

hide_read_pass()

{

	# shellcheck disable=SC2039

	if stty -echo 2>/dev/null; then

		read -r "$@"

		stty echo

	elif (set +o echo 2>/dev/null); then

		set +o echo

		read -r "$@"

		set -o echo

	elif (echo | read -r -s 2>/dev/null) ; then

		read -r -s "$@"

	else

		warn "Could not disable echo. Password will be shown on screen!"

		read -r "$@"

	fi

} # => hide_read_pass()

# build-ca backend:

build_ca() {

	opts=""

	sub_ca=""

	nopass=""

	crypto="-aes256"

	while [ -n "$1" ]; do

		case "$1" in

			intca) sub_ca=1 ;;

			subca) sub_ca=1 ;;

			nopass) nopass=1 ;;

			*) warn "Ignoring unknown command option: '$1'" ;;

		esac

		shift

	done

	verify_pki_init

	[ "$EASYRSA_ALGO" = "ec" ] && verify_curve_ec

	[ "$EASYRSA_ALGO" = "ed" ] && verify_curve_ed

	# setup for the simpler intermediate CA situation and overwrite with root-CA if needed:

	out_file="$EASYRSA_PKI/reqs/ca.req"

	out_key="$EASYRSA_PKI/private/ca.key"

	if [ ! $sub_ca ]; then

		out_file="$EASYRSA_PKI/ca.crt"

		opts="$opts -x509 -days $EASYRSA_CA_EXPIRE "

	fi

	# Test for existing CA, and complain if already present

	if verify_ca_init test; then

		die "\

Unable to create a CA as you already seem to have one set up.

If you intended to start a new CA, run init-pki first."

	fi

	# If a private key exists here, a intermediate ca was created but not signed.

	# Notify the user and require a signed ca.crt or a init-pki:

	[ -f "$out_key" ] && \

		die "\

A CA private key exists but no ca.crt is found in your PKI dir of:

$EASYRSA_PKI

Refusing to create a new CA keypair as this operation would overwrite your

current CA keypair. If you intended to start a new CA, run init-pki first."

	# create necessary files and dirs:

	err_file="Unable to create necessary PKI files (permissions?)"

	for i in issued certs_by_serial \

		 revoked/certs_by_serial revoked/private_by_serial revoked/reqs_by_serial \

		 renewed/certs_by_serial renewed/private_by_serial renewed/reqs_by_serial;

	do

		mkdir -p "$EASYRSA_PKI/$i" || die "$err_file"

	done

	printf "" > "$EASYRSA_PKI/index.txt" || die "$err_file"

	printf "" > "$EASYRSA_PKI/index.txt.attr" || die "$err_file"

	print "01" > "$EASYRSA_PKI/serial" || die "$err_file"

	# Default CN only when not in global EASYRSA_BATCH mode:

	# shellcheck disable=SC2015

	[ "$EASYRSA_BATCH" ] && opts="$opts -batch" || export EASYRSA_REQ_CN="Easy-RSA CA"

	out_key_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"

	out_file_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"

	# Get password from user if necessary

	if [ ! $nopass ] && ( [ -z "$EASYRSA_PASSOUT" ] || [ -z "$EASYRSA_PASSIN" ] ); then

		out_key_pass_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"

		echo

		printf "Enter New CA Key Passphrase: "

		hide_read_pass kpass

		echo

		printf "Re-Enter New CA Key Passphrase: "

		hide_read_pass kpass2

		echo

		# shellcheck disable=2154

		if [ "$kpass" = "$kpass2" ];

		then

			printf "%s" "$kpass" > "$out_key_pass_tmp"

		else

			die "Passphrases do not match."

		fi

	fi

	# create the CA key using AES256

	crypto_opts=""

	if [ ! $nopass ]; then

		crypto_opts="$crypto"

		[ -z "$EASYRSA_PASSOUT" ] && crypto_opts="$crypto_opts -passout file:$out_key_pass_tmp"

	fi

	if [ "$EASYRSA_ALGO" = "rsa" ]; then

		#shellcheck disable=SC2086

		"$EASYRSA_OPENSSL" genrsa -out "$out_key_tmp" $crypto_opts ${EASYRSA_PASSOUT:+-passout "$EASYRSA_PASSOUT"} "$EASYRSA_ALGO_PARAMS" || \

			die "Failed create CA private key"

	elif [ "$EASYRSA_ALGO" = "ec" ]; then

		#shellcheck disable=SC2086

		"$EASYRSA_OPENSSL" ecparam -in "$EASYRSA_ALGO_PARAMS" -genkey | \

			"$EASYRSA_OPENSSL" ec -out "$out_key_tmp" $crypto_opts ${EASYRSA_PASSOUT:+-passout "$EASYRSA_PASSOUT"} || \

			die "Failed create CA private key"

	elif [ "ed" = "$EASYRSA_ALGO" ]; then

		if [ "ed25519" = "$EASYRSA_CURVE" ]; then

			"$EASYRSA_OPENSSL" genpkey -algorithm ED25519  -out $out_key_tmp || \

			die "Failed create CA private key"

		elif [ "ed448" = "$EASYRSA_CURVE" ]; then

			"$EASYRSA_OPENSSL" genpkey -algorithm ED448 -out $out_key_tmp || \

			die "Failed create CA private key"

		fi

	fi

	# create the CA keypair:

	crypto_opts=""

	[ ! $nopass ] && [ -z "$EASYRSA_PASSIN" ] && crypto_opts="-passin file:$out_key_pass_tmp"

	#shellcheck disable=SC2086

	easyrsa_openssl req -utf8 -new -key "$out_key_tmp" \

		-keyout "$out_key_tmp" -out "$out_file_tmp" $crypto_opts $opts ${EASYRSA_PASSIN:+-passin "$EASYRSA_PASSIN"} || \

		die "Failed to build the CA"

	mv "$out_key_tmp" "$out_key"

	mv "$out_file_tmp" "$out_file"

	[ -f "$out_key_pass_tmp" ] && rm "$out_key_pass_tmp"

	# Success messages

	if [ $sub_ca ]; then

		notice "\

NOTE: Your intermediate CA request is at $out_file

and now must be sent to your parent CA for signing. Place your resulting cert

at $EASYRSA_PKI/ca.crt prior to signing operations.

"

	else	notice "\

CA creation complete and you may now import and sign cert requests.

Your new CA certificate file for publishing is at:

$out_file

"

	fi

	return 0

} # => build_ca()

# gen-dh backend:

gen_dh() {

	verify_pki_init

	out_file="$EASYRSA_PKI/dh.pem"

	"$EASYRSA_OPENSSL" dhparam -out "$out_file" "$EASYRSA_KEY_SIZE" || \

		die "Failed to build DH params"

	notice "\

DH parameters of size $EASYRSA_KEY_SIZE created at $out_file

"

	return 0

} # => gen_dh()

# gen-req backend:

gen_req() {

	# pull filename base and use as default interactive CommonName:

	[ -n "$1" ] || die "\

Error: gen-req must have a file base as the first argument.

Run easyrsa without commands for usage and commands."

	key_out="$EASYRSA_PKI/private/$1.key"

	req_out="$EASYRSA_PKI/reqs/$1.req"

	[ ! "$EASYRSA_BATCH" ] && EASYRSA_REQ_CN="$1"

	shift

	# function opts support

	opts=

	while [ -n "$1" ]; do

		case "$1" in

			nopass) opts="$opts -nodes" ;;

			# batch flag supports internal callers needing silent operation

			batch) EASYRSA_BATCH=1 ;;

			*) warn "Ignoring unknown command option: '$1'" ;;

		esac

		shift

	done

	verify_pki_init

	[ "$EASYRSA_ALGO" = "ec" ] && verify_curve_ec

	[ "$EASYRSA_ALGO" = "ed" ] && verify_curve_ed

	# don't wipe out an existing private key without confirmation

	[ -f "$key_out" ] && confirm "Confirm key overwrite: " "yes" "\

WARNING!!!

An existing private key was found at $key_out

Continuing with key generation will replace this key."

	# When EASYRSA_EXTRA_EXTS is defined, append it to openssl's [req] section:

	if [ -n "$EASYRSA_EXTRA_EXTS" ]; then

		# Setup & insert the extra ext data keyed by a magic line

		extra_exts="

req_extensions = req_extra

[ req_extra ]

$EASYRSA_EXTRA_EXTS"

		#shellcheck disable=SC2016

		awkscript='

{if ( match($0, "^#%EXTRA_EXTS%") )

	{ while ( getline<"/dev/stdin" ) {print} next }

 {print}

}'

		conf_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"

		print "$extra_exts" | \

			awk "$awkscript" "$EASYRSA_SSL_CONF" \

			> "$conf_tmp" \

			|| die "Copying SSL config to temp file failed"

		# Use this new SSL config for the rest of this function

		EASYRSA_SSL_CONF="$conf_tmp"

	fi

	key_out_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"

	req_out_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"

	# generate request

	[ $EASYRSA_BATCH ] && opts="$opts -batch"

	# shellcheck disable=2086,2148

	algo_opts=""

	if [ "ed" != $EASYRSA_ALGO ];then

		algo_opts=" -newkey $EASYRSA_ALGO:$EASYRSA_ALGO_PARAMS "

	fi

	easyrsa_openssl req -utf8 -new $algo_opts \

		-keyout "$key_out_tmp" -out "$req_out_tmp" $opts ${EASYRSA_PASSOUT:+-passout "$EASYRSA_PASSOUT"} \

		|| die "Failed to generate request"

	mv "$key_out_tmp" "$key_out"

	mv "$req_out_tmp" "$req_out"

	notice "\

Keypair and certificate request completed. Your files are:

req: $req_out

key: $key_out

"

	return 0

} # => gen_req()

# common signing backend

sign_req() {

	crt_type="$1"

	opts=""

	req_in="$EASYRSA_PKI/reqs/$2.req"

	crt_out="$EASYRSA_PKI/issued/$2.crt"

	# Randomize Serial number

	if [ "$EASYRSA_RAND_SN" != "no" ];

	then

		i=""

		serial=""

		check_serial=""

		for i in 1 2 3 4 5; do

			"$EASYRSA_OPENSSL" rand -hex -out "$EASYRSA_PKI/serial" 16

			serial="$(cat "$EASYRSA_PKI/serial")"

			check_serial="$("$EASYRSA_OPENSSL" ca -config "$EASYRSA_SSL_CONF" -status "$serial" 2>&1)"

			case "$check_serial" in

				*"not present in db"*) break ;;

				*) continue ;;

			esac

		done

	fi

	# Support batch by internal caller:

	[ "$3" = "batch" ] && EASYRSA_BATCH=1

	verify_ca_init

	# Check argument sanity:

	[ -n "$2" ] || die "\

Incorrect number of arguments provided to sign-req:

expected 2, got $# (see command help for usage)"

	# Cert type must exist under the EASYRSA_EXT_DIR

	[ -r "$EASYRSA_EXT_DIR/$crt_type" ] || die "\

Unknown cert type '$crt_type'"

	# Request file must exist

	[ -f "$req_in" ] || die "\

No request found for the input: '$2'

Expected to find the request at: $req_in"

	# Confirm input is a cert req

	verify_file req "$req_in" || die "\

The certificate request file is not in a valid X509 request format.

Offending file: $req_in"

	# Display the request subject in an easy-to-read format

	# Confirm the user wishes to sign this request

	confirm "Confirm request details: " "yes" "

You are about to sign the following certificate.

Please check over the details shown below for accuracy. Note that this request

has not been cryptographically verified. Please be sure it came from a trusted

source or that you have verified the request checksum with the sender.

Request subject, to be signed as a $crt_type certificate for $EASYRSA_CERT_EXPIRE days:

$(display_dn req "$req_in")

"	# => confirm end

	# Generate the extensions file for this cert:

	ext_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"

	{

		# Append first any COMMON file (if present) then the cert-type extensions

		cat "$EASYRSA_EXT_DIR/COMMON"

		cat "$EASYRSA_EXT_DIR/$crt_type"

		# copy req extensions

		[ "$EASYRSA_CP_EXT" ] && print "copy_extensions = copy"

		# Support a dynamic CA path length when present:

		[ "$crt_type" = "ca" ] && [ -n "$EASYRSA_SUBCA_LEN" ] && \

			print "basicConstraints = CA:TRUE, pathlen:$EASYRSA_SUBCA_LEN"

		# Deprecated Netscape extension support, if enabled

		if print "$EASYRSA_NS_SUPPORT" | awk_yesno; then

			[ -n "$EASYRSA_NS_COMMENT" ] && \

				print "nsComment = \"$EASYRSA_NS_COMMENT\""

			case "$crt_type" in

				serverClient)	print "nsCertType = serverClient" ;;

				server)		print "nsCertType = server" ;;

				client)		print "nsCertType = client" ;;

				ca)		print "nsCertType = sslCA" ;;

			esac

		fi

		# If type is server and no subjectAltName was requested,

		# add one to the extensions file

		if [ "$crt_type" = 'server' ] || [ "$crt_type" = 'serverClient' ];

		then

			echo "$EASYRSA_EXTRA_EXTS" | grep -q subjectAltName

			if [ $? -ne 0 ];

			then

				san=$(display_san req "$req_in")

				if [ -n "$san" ];

				then

					print "subjectAltName = $san"

				else

					default_server_san "$req_in"

				fi

			fi

		fi

		# Add any advanced extensions supplied by env-var:

		[ -n "$EASYRSA_EXTRA_EXTS" ] && print "$EASYRSA_EXTRA_EXTS"

		: # needed to keep die from inherting the above test

	} > "$ext_tmp" || die "\

Failed to create temp extension file (bad permissions?) at:

$ext_tmp"

	# sign request

	crt_out_tmp="$(easyrsa_mktemp)" || die "Failed to create temporary file"

	easyrsa_openssl ca -utf8 -in "$req_in" -out "$crt_out_tmp" \

		-extfile "$ext_tmp" -days "$EASYRSA_CERT_EXPIRE" -batch $opts ${EASYRSA_PASSIN:+-passin "$EASYRSA_PASSIN"} \

		|| die "signing failed (openssl output above may have more detail)"

	mv "$crt_out_tmp" "$crt_out"

	rm -f "$ext_tmp"

	notice "\

Certificate created at: $crt_out

"

	return 0

} # => sign_req()

# common build backend

# used to generate+sign in 1 step

build_full() {

	verify_ca_init

	# pull filename base:

	[ -n "$2" ] || die "\

Error: didn't find a file base name as the first argument.

Run easyrsa without commands for usage and commands."

	crt_type="$1" name="$2"

	req_out="$EASYRSA_PKI/reqs/$2.req"

	key_out="$EASYRSA_PKI/private/$2.key"

	crt_out="$EASYRSA_PKI/issued/$2.crt"

	shift 2

	# function opts support

	req_opts=

	while [ -n "$1" ]; do

		case "$1" in

			nopass) req_opts="$req_opts nopass" ;;

			inline) EASYRSA_INLINE=1 ;;

			*) warn "Ignoring unknown command option: '$1'" ;;

		esac

		shift

	done

	# abort on existing req/key/crt files

	err_exists="\

file already exists. Aborting build to avoid overwriting this file.

If you wish to continue, please use a different name or remove the file.

Matching file found at: "

	[ -f "$req_out" ] && die "Request $err_exists $req_out"

	[ -f "$key_out" ] && die "Key $err_exists $key_out"

	[ -f "$crt_out" ] && die "Certificate $err_exists $crt_out"

	# create request

	EASYRSA_REQ_CN="$name"

	#shellcheck disable=SC2086

	gen_req "$name" batch $req_opts

	# Sign it

	( sign_req "$crt_type" "$name" batch ) || {

		rm -f "$req_out" "$key_out"

		die "Failed to sign '$name'"

	}

	# inline it

	if [ $EASYRSA_INLINE ]; then

		inline_creds

	fi

} # => build_full()

# Create inline credentials file for this node

inline_creds ()

{

	[ -f "$EASYRSA_PKI/$EASYRSA_REQ_CN.creds" ] \

	&& die "Inline file exists: $EASYRSA_PKI/$EASYRSA_REQ_CN.creds"

	{

		printf "%s\n" "# $crt_type: $EASYRSA_REQ_CN"

		printf "%s\n" ""

		printf "%s\n" "<ca>"

		cat "$EASYRSA_PKI/ca.crt"

		printf "%s\n" "</ca>"

		printf "%s\n" ""

		printf "%s\n" "<cert>"

		cat "$crt_out"

		printf "%s\n" "</cert>"

		printf "%s\n" ""

		printf "%s\n" "<key>"

		cat "$key_out"

		printf "%s\n" "</key>"

		printf "%s\n" ""

	} > "$EASYRSA_PKI/$EASYRSA_REQ_CN.creds"

} # => inline_creds ()

# revoke backend

revoke() {

	verify_ca_init

	# pull filename base: