EASYRSA_EXTRA_EXTS ignored build build-ca

[openvpn]

EASYRSA_EXTRA_EXTS ignored build build-ca

[QueuingKoala]

Good point, thanks for the report.

I think the way to resolve this is to use the already-existing x509-types/ dir layout (which defaults to the currently supplied options in the .cnf file for the 'ca' type) and use the -extfile flag to the x509 command. The idea here is to make the CA signing process more like how sign_req() works currently, supporting both x509-types/ and env-var additions to the certificate extensions.

For sites that wish to use different options for a self-signed CA verses signing other sub-CA requests, the default 'ca' file under x509-types/ can be copied to a sub_ca extensions file, or the equivalent approach used with env-vars.

[TinCanTech]

This essentially boils down to build-ca supporting EASYRSA_EXTRA_EXTS.

Linking: #525

Solution:

• add:nameConstraints=permitted;DNS:example.com to x509-types/ca
• Pending #526

There is no env:vars solution, at this time.

[TinCanTech]

There is also another problem:

easy-rsa/easyrsa3/easyrsa

Lines 379 to 388 in 9970d62

	easyrsa_openssl_conf=$(easyrsa_mktemp) || die "Failed to create temporary file"
	easyrsa_extra_exts=
	if [ -n "$EASYRSA_EXTRA_EXTS" ]; then
	easyrsa_extra_exts=$(easyrsa_mktemp) || die "Failed to create temporary file"
	cat >"$easyrsa_extra_exts" <<-EOF
	req_extensions = req_extra
	[ req_extra ]
	$EASYRSA_EXTRA_EXTS
	EOF
	fi

req_extensions do not fly for CAs.

@luizluca EASYRSA_EXTRA_EXTS may not belong inside of easyrsa_openssl()

[TinCanTech]

The bottom_line is:

• EASYRSA_EXTRA_EXTS is not the variable to use for CA extensions.

PRs welcome.

Easy fix..

    EASYRSA_CA_EXTRA_EXTS="$EASYRSA_EXTRA_EXTS"
    unset -v EASYRSA_EXTRA_EXTS

[TinCanTech]

Feedback welcome.