Comments (2)
Hi, when signing a csr the confirmation screen shows different SAN entries than the final certificate will contain.
E.g.
./easyrsa --san="ipaddress:127.0.0.1" --san="DNS:localhost.localdomain" sign-req server myCSR
The confirmation screen will show the SAN entries as:
X509v3 Subject Alternative Name: ipaddress:127.0.0.1 DNS:localhost.localdomain Type the word 'yes' to continue(...)
but the final certificate will only have the last one "DNS:localhost.localdomain" within the SAN section.
Acknowledged.
Likely, caused by adding the new $EASYRSA_EXTRA_EXTS
to the current $EASYRSA_EXTRA_EXTS
:
Lines 5447 to 5451 in 6f45b81
The only example of such "option addition" in easyrsa
.
Signing validation screen should only show what is left after parsing and what will actually end up in the CRT.
Providing
--san
multiple times eihter should work as expected OR it should throw an exception. But it must not appear to work (esp. in the validate screen) and then cause an incorrect certificate to be signed.An additional sanity check and warning should be provided when the data from the final certificate differs from the data shown on the validate screen.
Agreed.
- "ipaddress:" should be an accepted alias for "IP:"
Negative.
from easy-rsa.
This seems to be a left-over from some obscure, early incantation of SAN as an easyrsa
option.
The idea that a LF
, inside an option that easyrsa
intends passing to openssl
, as a suitable solution to anything is questionable.
What-ever solution is applied, backward compatibility is not possible.
from easy-rsa.
Related Issues (20)
- Add CA certificate to expiry report `show-expire`
- Revert changes made for Windows 10/11 `mkdir -p` failure
- `dev/easyrsa-tools.lib` missing in release build HOT 1
- mandatory SAN HOT 16
- EasyRSA Behavior Change - 3.0.8 - 3.2.0 - EASYRSA_REQ_CN / --req-cn /--subject-alt-name HOT 18
- LibreSSL: `build-*-full` uses an incorrect SSL config file HOT 1
- UT failure from `easyrsa-tools.lib` for command `show-expire`
- Importing the CA certificates for OpenVPN clients and internal domains. HOT 1
- Outline use and expansion of `openssl-easyrsa.cnf` HOT 1
- Windows 7: `gen-crl` always prompts for over-write
- `display_dn()`: Remove unnecessary subshell
- `sign-req`: `--cop-ext` is removed by `--force-safe-ssl`
- Command `write`: Allow to specify target file instead of directory
- Use of `revoke` when `revoke-expired` is intended
- one location HOT 1
- Command `revoke` must not move key and request files
- `gen-req` overwrites an existing request without confirmation
- Need Guide for Upgrading 3.0.8 to 3.1.1 HOT 1
- Understanding how to renew/revoke HOT 2
- subjectAltName should be mandatory HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from easy-rsa.