1. openvpn
  2. Commit 8810c26cc5782addcf1f0a40212a7d1ebe827e6f
Browse code

Moved easy-rsa 2.0 scripts to easy-rsa/2.0 to be compatible with 2.0.x distribution.

git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@757 e7ae566f-a301-0410-adde-c780ea21d3b5

james authored on 2005/11/03 03:09:01
Showing 36 changed files
easy-rsa/2.0/README
History View file @ 8810c26
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,168 @@
0 
+EASY-RSA Version 2.0-rc1
1 
+
2 
+This is a small RSA key management package, based on the openssl
3 
+command line tool, that can be found in the easy-rsa subdirectory
4 
+of the OpenVPN distribution.
5 
+
6 
+These are reference notes.  For step-by-step instructions, see the
7 
+HOWTO:
8 
+
9 
+http://openvpn.net/howto.html
10 
+
11 
+This package is based on the ./pkitool script.  Run ./pkitool
12 
+without arguments for a detailed help message (which is also pasted
13 
+below).
14 
+
15 
+Release Notes for easy-rsa-2.0
16 
+
17 
+* Most functionality has been consolidated into the pkitool
18 
+  script. For compatibility, all previous scripts from 1.0 such
19 
+  as build-key and build-key-server are provided as stubs
20 
+  which call pkitool to do the real work.
21 
+
22 
+* pkitool has a --batch flag (enabled by default) which generates
23 
+  keys/certs without needing any interactive input.  pkitool
24 
+  can still generate certs/keys using interactive prompting by
25 
+  using the --interact flag.
26 
+
27 
+* The inherit-inter script has been provided for creating
28 
+  a new PKI rooted on an intermediate certificate built within a
29 
+  higher-level PKI.  See comments in the inherit-inter script
30 
+  for more info.
31 
+
32 
+* The openssl.cnf file has been modified.  pkitool will not
33 
+  work with the openssl.cnf file included with previous
34 
+  easy-rsa releases.
35 
+
36 
+* The vars file has been modified -- the following extra
37 
+  variables have been added: EASY_RSA, CA_EXPIRE,
38 
+  KEY_EXPIRE.
39 
+
40 
+* The make-crl and revoke-crt scripts have been removed and
41 
+  are replaced by the revoke-full script.
42 
+
43 
+* The "Organizational Unit" X509 field can be set using
44 
+  the KEY_OU environmental variable before calling pkitool.
45 
+
46 
+* This release only affects the Linux/Unix version of easy-rsa.
47 
+  The Windows version (written to use the Windows shell) is unchanged.
48 
+
49 
+INSTALL easy-rsa
50 
+
51 
+1. Edit vars.
52 
+2. Set KEY_CONFIG to point to the openssl.cnf file
53 
+   included in this distribution.
54 
+3. Set KEY_DIR to point to a directory which will
55 
+   contain all keys, certificates, etc.  This
56 
+   directory need not exist, and if it does,
57 
+   it will be deleted with rm -rf, so BE
58 
+   CAREFUL how you set KEY_DIR.
59 
+4. (Optional) Edit other fields in vars
60 
+   per your site data.  You may want to
61 
+   increase KEY_SIZE to 2048 if you are
62 
+   paranoid and don't mind slower key
63 
+   processing, but certainly 1024 is
64 
+   fine for testing purposes.  KEY_SIZE
65 
+   must be compatible across both peers
66 
+   participating in a secure SSL/TLS
67 
+   connection.
68 
+5  . vars
69 
+6. ./clean-all
70 
+7. As you create certificates, keys, and
71 
+   certificate signing requests, understand that
72 
+   only .key files should be kept confidential.
73 
+   .crt and .csr files can be sent over insecure
74 
+   channels such as plaintext email.
75 
+
76 
+IMPORTANT
77 
+
78 
+To avoid a possible Man-in-the-Middle attack where an authorized
79 
+client tries to connect to another client by impersonating the
80 
+server, make sure to enforce some kind of server certificate
81 
+verification by clients.  There are currently four different ways
82 
+of accomplishing this, listed in the order of preference:
83 
+
84 
+(1) Build your server certificates with the build-key-server
85 
+    script, or using the --server option to pkitool.
86 
+    This will designate the certificate as a
87 
+    server-only certificate by setting nsCertType=server.
88 
+    Now add the following line to your client configuration:
89 
+
90 
+    ns-cert-type server
91 
+
92 
+    This will block clients from connecting to any
93 
+    server which lacks the nsCertType=server designation
94 
+    in its certificate, even if the certificate has been
95 
+    signed by the CA which is cited in the OpenVPN configuration
96 
+    file (--ca directive).
97 
+
98 
+(2) Use the --tls-remote directive on the client to
99 
+    accept/reject the server connection based on the common
100 
+    name of the server certificate.
101 
+
102 
+(3) Use a --tls-verify script or plugin to accept/reject the
103 
+    server connection based on a custom test of the server
104 
+    certificate's embedded X509 subject details.
105 
+
106 
+(4) Sign server certificates with one CA and client certificates
107 
+    with a different CA.  The client config "ca" directive should
108 
+    reference the server-signing CA while the server config "ca"
109 
+    directive should reference the client-signing CA.
110 
+
111 
+NOTES
112 
+
113 
+Show certificate fields:
114 
+  openssl x509 -in cert.crt -text
115 
+
116 
+PKITOOL documentation
117 
+
118 
+pkitool 2.0
119 
+Usage: pkitool [options...] [common-name]
120 
+Options:
121 
+  --batch    : batch mode (default)
122 
+  --interact : interactive mode
123 
+  --server   : build server cert
124 
+  --initca   : build root CA
125 
+  --inter    : build intermediate CA
126 
+  --pass     : encrypt private key with password
127 
+  --csr      : only generate a CSR, do not sign
128 
+  --sign     : sign an existing CSR
129 
+  --pkcs12   : generate a combined pkcs12 file
130 
+Notes:
131 
+  Please edit the vars script to reflect your configuration,
132 
+  then source it with "source ./vars".
133 
+  Next, to start with a fresh PKI configuration and to delete any
134 
+  previous certificates and keys, run "./clean-all".
135 
+  Finally, you can run this tool (pkitool) to build certificates/keys.
136 
+Generated files and corresponding OpenVPN directives:
137 
+(Files will be placed in the $KEY_DIR directory, defined in ./vars)
138 
+  ca.crt     -> root certificate (--ca)
139 
+  ca.key     -> root key, keep secure (not directly used by OpenVPN)
140 
+  .crt files -> client/server certificates (--cert)
141 
+  .key files -> private keys, keep secure (--key)
142 
+  .csr files -> certificate signing request (not directly used by OpenVPN)
143 
+  dh1024.pem or dh2048.pem -> Diffie Hellman parameters (--dh)
144 
+Examples:
145 
+  pkitool --initca          -> Build root certificate
146 
+  pkitool --initca --pass   -> Build root certificate with password-protected key
147 
+  pkitool --server server1  -> Build "server1" certificate/key
148 
+  pkitool client1           -> Build "client1" certificate/key
149 
+  pkitool --pass client2    -> Build password-protected "client2" certificate/key
150 
+  pkitool --pkcs12 client3  -> Build "client3" certificate/key in PKCS #12 format
151 
+  pkitool --csr client4     -> Build "client4" CSR to be signed by another CA
152 
+  pkitool --sign client4    -> Sign "client4" CSR
153 
+  pkitool --inter interca   -> Build an intermediate key-signing certificate/key
154 
+                               Also see ./inherit-inter script.
155 
+Typical usage for initial PKI setup.  Build myserver, client1, and client2 cert/keys.
156 
+Protect client2 key with a password.  Build DH parms.  Generated files in ./keys :
157 
+  [edit vars with your site-specific info]
158 
+  source ./vars
159 
+  ./clean-all
160 
+  ./build-dh     -> takes a long time, consider backgrounding
161 
+  ./pkitool --initca
162 
+  ./pkitool --server myserver
163 
+  ./pkitool client1
164 
+  ./pkitool --pass client2
165 
+Typical usage for adding client cert to existing PKI:
166 
+  source ./vars
167 
+  ./pkitool client-new
easy-rsa/2.0/build-ca
History View file @ 8810c26
0 168 
new file mode 100755
... ... 
@@ -0,0 +1,8 @@
0 
+#!/bin/bash
1 
+
2 
+#
3 
+# Build a root certificate
4 
+#
5 
+
6 
+export EASY_RSA="${EASY_RSA:-.}"
7 
+"$EASY_RSA/pkitool" --interact --initca $*
easy-rsa/2.0/build-dh
History View file @ 8810c26
0 8 
new file mode 100755
... ... 
@@ -0,0 +1,11 @@
0 
+#!/bin/bash
1 
+
2 
+# Build Diffie-Hellman parameters for the server side
3 
+# of an SSL/TLS connection.
4 
+
5 
+if [ -d $KEY_DIR ] && [ $KEY_SIZE ]; then
6 
+    openssl dhparam -out ${KEY_DIR}/dh${KEY_SIZE}.pem ${KEY_SIZE}
7 
+else
8 
+    echo 'Please source the vars script first (i.e. "source ./vars")'
9 
+    echo 'Make sure you have edited it to reflect your configuration.'
10 
+fi
easy-rsa/2.0/build-inter
History View file @ 8810c26
0 11 
new file mode 100755
... ... 
@@ -0,0 +1,7 @@
0 
+#!/bin/bash
1 
+
2 
+# Make an intermediate CA certificate/private key pair using a locally generated
3 
+# root certificate.
4 
+
5 
+export EASY_RSA="${EASY_RSA:-.}"
6 
+"$EASY_RSA/pkitool" --interact --inter $*
easy-rsa/2.0/build-key
History View file @ 8810c26
0 7 
new file mode 100755
... ... 
@@ -0,0 +1,7 @@
0 
+#!/bin/bash
1 
+
2 
+# Make a certificate/private key pair using a locally generated
3 
+# root certificate.
4 
+
5 
+export EASY_RSA="${EASY_RSA:-.}"
6 
+"$EASY_RSA/pkitool" --interact $*
easy-rsa/2.0/build-key-pass
History View file @ 8810c26
0 7 
new file mode 100755
... ... 
@@ -0,0 +1,7 @@
0 
+#!/bin/bash
1 
+
2 
+# Similar to build-key, but protect the private key
3 
+# with a password.
4 
+
5 
+export EASY_RSA="${EASY_RSA:-.}"
6 
+"$EASY_RSA/pkitool" --interact --pass $*
easy-rsa/2.0/build-key-pkcs12
History View file @ 8810c26
0 7 
new file mode 100755
... ... 
@@ -0,0 +1,8 @@
0 
+#!/bin/bash
1 
+
2 
+# Make a certificate/private key pair using a locally generated
3 
+# root certificate and convert it to a PKCS #12 file including the
4 
+# the CA certificate as well.
5 
+
6 
+export EASY_RSA="${EASY_RSA:-.}"
7 
+"$EASY_RSA/pkitool" --interact --pkcs12 $*
easy-rsa/2.0/build-key-server
History View file @ 8810c26
0 8 
new file mode 100755
... ... 
@@ -0,0 +1,10 @@
0 
+#!/bin/bash
1 
+
2 
+# Make a certificate/private key pair using a locally generated
3 
+# root certificate.
4 
+#
5 
+# Explicitly set nsCertType to server using the "server"
6 
+# extension in the openssl.cnf file.
7 
+
8 
+export EASY_RSA="${EASY_RSA:-.}"
9 
+"$EASY_RSA/pkitool" --interact --server $*
easy-rsa/2.0/build-req
History View file @ 8810c26
0 10 
new file mode 100755
... ... 
@@ -0,0 +1,7 @@
0 
+#!/bin/bash
1 
+
2 
+# Build a certificate signing request and private key.  Use this
3 
+# when your root certificate and key is not available locally.
4 
+
5 
+export EASY_RSA="${EASY_RSA:-.}"
6 
+"$EASY_RSA/pkitool" --interact --csr $*
easy-rsa/2.0/build-req-pass
History View file @ 8810c26
0 7 
new file mode 100755
... ... 
@@ -0,0 +1,7 @@
0 
+#!/bin/bash
1 
+
2 
+# Like build-req, but protect your private key
3 
+# with a password.
4 
+
5 
+export EASY_RSA="${EASY_RSA:-.}"
6 
+"$EASY_RSA/pkitool" --interact --csr --pass $*
easy-rsa/2.0/clean-all
History View file @ 8810c26
0 7 
new file mode 100755
... ... 
@@ -0,0 +1,16 @@
0 
+#!/bin/bash
1 
+
2 
+# Initialize the $KEY_DIR directory.
3 
+# Note that this script does a
4 
+# rm -rf on $KEY_DIR so be careful!
5 
+
6 
+if [ "$KEY_DIR" ]; then
7 
+    rm -rf "$KEY_DIR"
8 
+    mkdir "$KEY_DIR" && \
9 
+	chmod go-rwx "$KEY_DIR" && \
10 
+	touch "$KEY_DIR/index.txt" && \
11 
+	echo 01 >"$KEY_DIR/serial"
12 
+else
13 
+    echo 'Please source the vars script first (i.e. "source ./vars")'
14 
+    echo 'Make sure you have edited it to reflect your configuration.'
15 
+fi
easy-rsa/2.0/inherit-inter
History View file @ 8810c26
0 16 
new file mode 100755
... ... 
@@ -0,0 +1,39 @@
0 
+#!/bin/bash
1 
+
2 
+# Build a new PKI which is rooted on an intermediate certificate generated
3 
+# by ./build-inter or ./pkitool --inter from a parent PKI.  The new PKI should
4 
+# have independent vars settings, and must use a different KEY_DIR directory
5 
+# from the parent.  This tool can be used to generate arbitrary depth
6 
+# certificate chains.
7 
+#
8 
+# To build an intermediate CA, follow the same steps for a regular PKI but
9 
+# replace ./build-key or ./pkitool --initca with this script.
10 
+
11 
+# The EXPORT_CA file will contain the CA certificate chain and should be
12 
+# referenced by the OpenVPN "ca" directive in config files.  The ca.crt file
13 
+# will only contain the local intermediate CA -- it's needed by the easy-rsa
14 
+# scripts but not by OpenVPN directly.
15 
+EXPORT_CA="export-ca.crt"
16 
+
17 
+if [ $# -ne 2 ]; then
18 
+    echo "usage: $0 <parent-key-dir> <common-name>"
19 
+    echo "parent-key-dir: the KEY_DIR directory of the parent PKI"
20 
+    echo "common-name: the common name of the intermediate certificate in the parent PKI"
21 
+    exit 1;
22 
+fi
23 
+
24 
+if [ "$KEY_DIR" ]; then
25 
+    cp "$1/$2.crt" "$KEY_DIR/ca.crt"
26 
+    cp "$1/$2.key" "$KEY_DIR/ca.key"
27 
+
28 
+    if [ -e "$1/$EXPORT_CA" ]; then
29 
+	PARENT_CA="$1/$EXPORT_CA"
30 
+    else
31 
+	PARENT_CA="$1/ca.crt"
32 
+    fi
33 
+    cp "$PARENT_CA" "$KEY_DIR/$EXPORT_CA"
34 
+    cat "$KEY_DIR/ca.crt" >> "$KEY_DIR/$EXPORT_CA"
35 
+else
36 
+    echo 'Please source the vars script first (i.e. "source ./vars")'
37 
+    echo 'Make sure you have edited it to reflect your configuration.'
38 
+fi
easy-rsa/2.0/list-crl
History View file @ 8810c26
0 39 
new file mode 100755
... ... 
@@ -0,0 +1,13 @@
0 
+#!/bin/bash
1 
+
2 
+# list revoked certificates
3 
+
4 
+CRL="${1:-crl.pem}"
5 
+
6 
+if [ "$KEY_DIR" ]; then
7 
+    cd "$KEY_DIR" && \
8 
+	openssl crl -text -noout -in "$CRL"
9 
+else
10 
+    echo 'Please source the vars script first (i.e. "source ./vars")'
11 
+    echo 'Make sure you have edited it to reflect your configuration.'
12 
+fi
easy-rsa/2.0/openssl.cnf
History View file @ 8810c26
0 13 
new file mode 100755
... ... 
@@ -0,0 +1,261 @@
0 
+# For use with easy-rsa version 2.0
1 
+
2 
+#
3 
+# OpenSSL example configuration file.
4 
+# This is mostly being used for generation of certificate requests.
5 
+#
6 
+
7 
+# This definition stops the following lines choking if HOME isn't
8 
+# defined.
9 
+HOME			= .
10 
+RANDFILE		= $ENV::HOME/.rnd
11 
+
12 
+# Extra OBJECT IDENTIFIER info:
13 
+#oid_file		= $ENV::HOME/.oid
14 
+oid_section		= new_oids
15 
+
16 
+# To use this configuration file with the "-extfile" option of the
17 
+# "openssl x509" utility, name here the section containing the
18 
+# X.509v3 extensions to use:
19 
+# extensions		=
20 
+# (Alternatively, use a configuration file that has only
21 
+# X.509v3 extensions in its main [= default] section.)
22 
+
23 
+[ new_oids ]
24 
+
25 
+# We can add new OIDs in here for use by 'ca' and 'req'.
26 
+# Add a simple OID like this:
27 
+# testoid1=1.2.3.4
28 
+# Or use config file substitution like this:
29 
+# testoid2=${testoid1}.5.6
30 
+
31 
+####################################################################
32 
+[ ca ]
33 
+default_ca	= CA_default		# The default ca section
34 
+
35 
+####################################################################
36 
+[ CA_default ]
37 
+
38 
+dir		= $ENV::KEY_DIR		# Where everything is kept
39 
+certs		= $dir			# Where the issued certs are kept
40 
+crl_dir		= $dir			# Where the issued crl are kept
41 
+database	= $dir/index.txt	# database index file.
42 
+new_certs_dir	= $dir			# default place for new certs.
43 
+
44 
+certificate	= $dir/ca.crt	 	# The CA certificate
45 
+serial		= $dir/serial 		# The current serial number
46 
+crl		= $dir/crl.pem 		# The current CRL
47 
+private_key	= $dir/ca.key	 	# The private key
48 
+RANDFILE	= $dir/.rand		# private random number file
49 
+
50 
+x509_extensions	= usr_cert		# The extentions to add to the cert
51 
+
52 
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
53 
+# so this is commented out by default to leave a V1 CRL.
54 
+# crl_extensions	= crl_ext
55 
+
56 
+default_days	= 3650			# how long to certify for
57 
+default_crl_days= 30			# how long before next CRL
58 
+default_md	= md5			# which md to use.
59 
+preserve	= no			# keep passed DN ordering
60 
+
61 
+# A few difference way of specifying how similar the request should look
62 
+# For type CA, the listed attributes must be the same, and the optional
63 
+# and supplied fields are just that :-)
64 
+policy		= policy_anything
65 
+
66 
+# For the CA policy
67 
+[ policy_match ]
68 
+countryName		= match
69 
+stateOrProvinceName	= match
70 
+organizationName	= match
71 
+organizationalUnitName	= optional
72 
+commonName		= supplied
73 
+emailAddress		= optional
74 
+
75 
+# For the 'anything' policy
76 
+# At this point in time, you must list all acceptable 'object'
77 
+# types.
78 
+[ policy_anything ]
79 
+countryName		= optional
80 
+stateOrProvinceName	= optional
81 
+localityName		= optional
82 
+organizationName	= optional
83 
+organizationalUnitName	= optional
84 
+commonName		= supplied
85 
+emailAddress		= optional
86 
+
87 
+####################################################################
88 
+[ req ]
89 
+default_bits		= $ENV::KEY_SIZE
90 
+default_keyfile 	= privkey.pem
91 
+distinguished_name	= req_distinguished_name
92 
+attributes		= req_attributes
93 
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
94 
+
95 
+# Passwords for private keys if not present they will be prompted for
96 
+# input_password = secret
97 
+# output_password = secret
98 
+
99 
+# This sets a mask for permitted string types. There are several options.
100 
+# default: PrintableString, T61String, BMPString.
101 
+# pkix	 : PrintableString, BMPString.
102 
+# utf8only: only UTF8Strings.
103 
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
104 
+# MASK:XXXX a literal mask value.
105 
+# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
106 
+# so use this option with caution!
107 
+string_mask = nombstr
108 
+
109 
+# req_extensions = v3_req # The extensions to add to a certificate request
110 
+
111 
+[ req_distinguished_name ]
112 
+countryName			= Country Name (2 letter code)
113 
+countryName_default		= $ENV::KEY_COUNTRY
114 
+countryName_min			= 2
115 
+countryName_max			= 2
116 
+
117 
+stateOrProvinceName		= State or Province Name (full name)
118 
+stateOrProvinceName_default	= $ENV::KEY_PROVINCE
119 
+
120 
+localityName			= Locality Name (eg, city)
121 
+localityName_default		= $ENV::KEY_CITY
122 
+
123 
+0.organizationName		= Organization Name (eg, company)
124 
+0.organizationName_default	= $ENV::KEY_ORG
125 
+
126 
+# we can do this but it is not needed normally :-)
127 
+#1.organizationName		= Second Organization Name (eg, company)
128 
+#1.organizationName_default	= World Wide Web Pty Ltd
129 
+
130 
+organizationalUnitName		= Organizational Unit Name (eg, section)
131 
+#organizationalUnitName_default	=
132 
+
133 
+commonName			= Common Name (eg, your name or your server\'s hostname)
134 
+commonName_max			= 64
135 
+
136 
+emailAddress			= Email Address
137 
+emailAddress_default		= $ENV::KEY_EMAIL
138 
+emailAddress_max		= 40
139 
+
140 
+# JY -- added for batch mode
141 
+organizationalUnitName_default = $ENV::KEY_OU
142 
+commonName_default = $ENV::KEY_CN
143 
+
144 
+# SET-ex3			= SET extension number 3
145 
+
146 
+[ req_attributes ]
147 
+challengePassword		= A challenge password
148 
+challengePassword_min		= 4
149 
+challengePassword_max		= 20
150 
+
151 
+unstructuredName		= An optional company name
152 
+
153 
+[ usr_cert ]
154 
+
155 
+# These extensions are added when 'ca' signs a request.
156 
+
157 
+# This goes against PKIX guidelines but some CAs do it and some software
158 
+# requires this to avoid interpreting an end user certificate as a CA.
159 
+
160 
+basicConstraints=CA:FALSE
161 
+
162 
+# Here are some examples of the usage of nsCertType. If it is omitted
163 
+# the certificate can be used for anything *except* object signing.
164 
+
165 
+# This is OK for an SSL server.
166 
+# nsCertType			= server
167 
+
168 
+# For an object signing certificate this would be used.
169 
+# nsCertType = objsign
170 
+
171 
+# For normal client use this is typical
172 
+# nsCertType = client, email
173 
+
174 
+# and for everything including object signing:
175 
+# nsCertType = client, email, objsign
176 
+
177 
+# This is typical in keyUsage for a client certificate.
178 
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
179 
+
180 
+# This will be displayed in Netscape's comment listbox.
181 
+nsComment			= "OpenSSL Generated Certificate"
182 
+
183 
+# PKIX recommendations harmless if included in all certificates.
184 
+subjectKeyIdentifier=hash
185 
+authorityKeyIdentifier=keyid,issuer:always
186 
+
187 
+# This stuff is for subjectAltName and issuerAltname.
188 
+# Import the email address.
189 
+# subjectAltName=email:copy
190 
+
191 
+# Copy subject details
192 
+# issuerAltName=issuer:copy
193 
+
194 
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
195 
+#nsBaseUrl
196 
+#nsRevocationUrl
197 
+#nsRenewalUrl
198 
+#nsCaPolicyUrl
199 
+#nsSslServerName
200 
+
201 
+[ server ]
202 
+
203 
+# JY ADDED -- Make a cert with nsCertType set to "server"
204 
+basicConstraints=CA:FALSE
205 
+nsCertType			= server
206 
+nsComment			= "OpenSSL Generated Server Certificate"
207 
+subjectKeyIdentifier=hash
208 
+authorityKeyIdentifier=keyid,issuer:always
209 
+
210 
+[ v3_req ]
211 
+
212 
+# Extensions to add to a certificate request
213 
+
214 
+basicConstraints = CA:FALSE
215 
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
216 
+
217 
+[ v3_ca ]
218 
+
219 
+
220 
+# Extensions for a typical CA
221 
+
222 
+
223 
+# PKIX recommendation.
224 
+
225 
+subjectKeyIdentifier=hash
226 
+
227 
+authorityKeyIdentifier=keyid:always,issuer:always
228 
+
229 
+# This is what PKIX recommends but some broken software chokes on critical
230 
+# extensions.
231 
+#basicConstraints = critical,CA:true
232 
+# So we do this instead.
233 
+basicConstraints = CA:true
234 
+
235 
+# Key usage: this is typical for a CA certificate. However since it will
236 
+# prevent it being used as an test self-signed certificate it is best
237 
+# left out by default.
238 
+# keyUsage = cRLSign, keyCertSign
239 
+
240 
+# Some might want this also
241 
+# nsCertType = sslCA, emailCA
242 
+
243 
+# Include email address in subject alt name: another PKIX recommendation
244 
+# subjectAltName=email:copy
245 
+# Copy issuer details
246 
+# issuerAltName=issuer:copy
247 
+
248 
+# DER hex encoding of an extension: beware experts only!
249 
+# obj=DER:02:03
250 
+# Where 'obj' is a standard or added object
251 
+# You can even override a supported extension:
252 
+# basicConstraints= critical, DER:30:03:01:01:FF
253 
+
254 
+[ crl_ext ]
255 
+
256 
+# CRL extensions.
257 
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
258 
+
259 
+# issuerAltName=issuer:copy
260 
+authorityKeyIdentifier=keyid:always,issuer:always
easy-rsa/2.0/pkitool
History View file @ 8810c26
0 261 
new file mode 100755
... ... 
@@ -0,0 +1,233 @@
0 
+#!/bin/sh
1 
+
2 
+#  OpenVPN -- An application to securely tunnel IP networks
3 
+#             over a single TCP/UDP port, with support for SSL/TLS-based
4 
+#             session authentication and key exchange,
5 
+#             packet encryption, packet authentication, and
6 
+#             packet compression.
7 
+#
8 
+#  Copyright (C) 2002-2005 OpenVPN Solutions LLC <info@openvpn.net>
9 
+#
10 
+#  This program is free software; you can redistribute it and/or modify
11 
+#  it under the terms of the GNU General Public License version 2
12 
+#  as published by the Free Software Foundation.
13 
+#
14 
+#  This program is distributed in the hope that it will be useful,
15 
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
16 
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17 
+#  GNU General Public License for more details.
18 
+#
19 
+#  You should have received a copy of the GNU General Public License
20 
+#  along with this program (see the file COPYING included with this
21 
+#  distribution); if not, write to the Free Software Foundation, Inc.,
22 
+#  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
23 
+
24 
+# pkitool is a front-end for the openssl tool.
25 
+
26 
+# Calling scripts can set the certificate organizational
27 
+# unit with the KEY_OU environmental variable.
28 
+
29 
+PROGNAME=pkitool
30 
+VERSION=2.0
31 
+DEBUG=0
32 
+
33 
+GREP=grep
34 
+OPENSSL=openssl
35 
+
36 
+need_vars()
37 
+{
38 
+    echo '  Please edit the vars script to reflect your configuration,'
39 
+    echo '  then source it with "source ./vars".'
40 
+    echo '  Next, to start with a fresh PKI configuration and to delete any'
41 
+    echo '  previous certificates and keys, run "./clean-all".'
42 
+    echo "  Finally, you can run this tool ($PROGNAME) to build certificates/keys."
43 
+}
44 
+
45 
+usage()
46 
+{
47 
+    echo "$PROGNAME $VERSION"
48 
+    echo "Usage: $PROGNAME [options...] [common-name]"
49 
+    echo "Options:"
50 
+    echo "  --batch    : batch mode (default)"
51 
+    echo "  --interact : interactive mode"
52 
+    echo "  --server   : build server cert"
53 
+    echo "  --initca   : build root CA"
54 
+    echo "  --inter    : build intermediate CA"
55 
+    echo "  --pass     : encrypt private key with password"
56 
+    echo "  --csr      : only generate a CSR, do not sign"
57 
+    echo "  --sign     : sign an existing CSR"
58 
+    echo "  --pkcs12   : generate a combined pkcs12 file"
59 
+    echo "Notes:"
60 
+    need_vars
61 
+    echo "Generated files and corresponding OpenVPN directives:"
62 
+    echo '(Files will be placed in the $KEY_DIR directory, defined in ./vars)'
63 
+    echo "  ca.crt     -> root certificate (--ca)"
64 
+    echo "  ca.key     -> root key, keep secure (not directly used by OpenVPN)"
65 
+    echo "  .crt files -> client/server certificates (--cert)"
66 
+    echo "  .key files -> private keys, keep secure (--key)"
67 
+    echo "  .csr files -> certificate signing request (not directly used by OpenVPN)"
68 
+    echo "  dh1024.pem or dh2048.pem -> Diffie Hellman parameters (--dh)"
69 
+    echo "Examples:"
70 
+    echo "  $PROGNAME --initca          -> Build root certificate"
71 
+    echo "  $PROGNAME --initca --pass   -> Build root certificate with password-protected key"
72 
+    echo "  $PROGNAME --server server1  -> Build \"server1\" certificate/key"
73 
+    echo "  $PROGNAME client1           -> Build \"client1\" certificate/key"
74 
+    echo "  $PROGNAME --pass client2    -> Build password-protected \"client2\" certificate/key"
75 
+    echo "  $PROGNAME --pkcs12 client3  -> Build \"client3\" certificate/key in PKCS #12 format"
76 
+    echo "  $PROGNAME --csr client4     -> Build \"client4\" CSR to be signed by another CA"
77 
+    echo "  $PROGNAME --sign client4    -> Sign \"client4\" CSR"
78 
+    echo "  $PROGNAME --inter interca   -> Build an intermediate key-signing certificate/key"
79 
+    echo "                               Also see ./inherit-inter script."
80 
+    echo "Typical usage for initial PKI setup.  Build myserver, client1, and client2 cert/keys."
81 
+    echo "Protect client2 key with a password.  Build DH parms.  Generated files in ./keys :"
82 
+    echo "  [edit vars with your site-specific info]"
83 
+    echo "  source ./vars"
84 
+    echo "  ./clean-all"
85 
+    echo "  ./build-dh     -> takes a long time, consider backgrounding"
86 
+    echo "  ./$PROGNAME --initca"
87 
+    echo "  ./$PROGNAME --server myserver"
88 
+    echo "  ./$PROGNAME client1"
89 
+    echo "  ./$PROGNAME --pass client2"
90 
+    echo "Typical usage for adding client cert to existing PKI:"
91 
+    echo "  source ./vars"
92 
+    echo "  ./$PROGNAME client-new"
93 
+}
94 
+
95 
+# Set defaults
96 
+DO_REQ="1"
97 
+REQ_EXT=""
98 
+DO_CA="1"
99 
+CA_EXT=""
100 
+DO_P12="0"
101 
+DO_ROOT="0"
102 
+NODES_REQ="-nodes"
103 
+NODES_P12=""
104 
+BATCH="-batch"
105 
+CA="ca"
106 
+
107 
+# Process options
108 
+while [ $# -gt 0 ]; do
109 
+    case "$1" in
110 
+	--server   ) REQ_EXT="$REQ_EXT -extensions server"
111 
+	             CA_EXT="$CA_EXT -extensions server" ;;
112 
+	--batch    ) BATCH="-batch" ;;
113 
+	--interact ) BATCH="" ;;
114 
+        --inter    ) CA_EXT="$CA_EXT -extensions v3_ca" ;;
115 
+        --initca   ) DO_ROOT="1" ;;
116 
+	--pass     ) NODES_REQ="" ;;
117 
+        --csr      ) DO_CA="0" ;;
118 
+        --sign     ) DO_REQ="0" ;;
119 
+        --pkcs12   ) DO_P12="1" ;;
120 
+	--*        ) echo "$PROGNAME: unknown option: $1"
121 
+	             exit 1 ;;
122 
+	*          ) break ;;
123 
+    esac
124 
+    shift
125 
+done
126 
+
127 
+# If we are generating pkcs12, only encrypt the final step
128 
+if [ $DO_P12 -eq 1 ]; then
129 
+    NODES_P12="$NODES_REQ"
130 
+    NODES_REQ="-nodes"
131 
+fi
132 
+
133 
+# If undefined, set default key expiration intervals
134 
+if [ -z "$KEY_EXPIRE" ]; then
135 
+    KEY_EXPIRE=3650
136 
+fi
137 
+if [ -z "$CA_EXPIRE" ]; then
138 
+    CA_EXPIRE=3650
139 
+fi
140 
+
141 
+# Set organizational unit to empty string if undefined
142 
+if [ -z "$KEY_OU" ]; then
143 
+    KEY_OU=""
144 
+fi
145 
+
146 
+# Set KEY_CN
147 
+if [ $DO_ROOT -eq 1 ]; then
148 
+    if [ -z "$KEY_CN" ]; then
149 
+	if [ "$1" ]; then
150 
+	    KEY_CN="$1"
151 
+	elif [ "$KEY_ORG" ]; then
152 
+	    KEY_CN="$KEY_ORG CA"
153 
+	fi
154 
+    fi
155 
+    if [ $BATCH ] && [ "$KEY_CN" ]; then
156 
+	echo "Using CA Common Name:" $KEY_CN
157 
+    fi
158 
+elif [ $BATCH ] && [ "$KEY_CN" ] && [ $# -eq 0 ]; then
159 
+    echo "Using Common Name:" $KEY_CN
160 
+else
161 
+    if [ $# -ne 1 ]; then
162 
+	usage
163 
+	exit 1
164 
+    else
165 
+	KEY_CN="$1"
166 
+    fi
167 
+fi
168 
+export CA_EXPIRE KEY_EXPIRE KEY_OU KEY_CN
169 
+
170 
+# Show parameters (debugging)
171 
+if [ $DEBUG -eq 1 ]; then
172 
+    echo DO_REQ $DO_REQ
173 
+    echo REQ_EXT $REQ_EXT
174 
+    echo DO_CA $DO_CA
175 
+    echo CA_EXT $CA_EXT
176 
+    echo NODES_REQ $NODES_REQ
177 
+    echo NODES_P12 $NODES_P12
178 
+    echo DO_P12 $DO_P12
179 
+    echo KEY_CN $KEY_CN
180 
+    echo BATCH $BATCH
181 
+    echo DO_ROOT $DO_ROOT
182 
+    echo KEY_EXPIRE $KEY_EXPIRE
183 
+    echo CA_EXPIRE $CA_EXPIRE
184 
+    echo KEY_OU $KEY_OU
185 
+fi
186 
+
187 
+# Make sure ./vars was sourced beforehand
188 
+if [ -d "$KEY_DIR" ] && [ "$KEY_CONFIG" ]; then
189 
+    cd "$KEY_DIR"
190 
+
191 
+    # Make sure $KEY_CONFIG points to the correct version
192 
+    # of openssl.cnf
193 
+    if $GREP -i 'easy-rsa version 2\.[0-9]' "$KEY_CONFIG" >/dev/null; then
194 
+	:
195 
+    else
196 
+	echo "$PROGNAME: KEY_CONFIG (set by the ./vars script) is pointing to the wrong"
197 
+        echo "version of openssl.cnf: $KEY_CONFIG"
198 
+	echo "The correct version should have a comment that says: easy-rsa version 2.x";
199 
+	exit 1;
200 
+    fi
201 
+
202 
+    # Build root CA
203 
+    if [ $DO_ROOT -eq 1 ]; then
204 
+	$OPENSSL req $BATCH -days $CA_EXPIRE $NODES_REQ -new -x509 \
205 
+	    -keyout "$CA.key" -out "$CA.crt" -config "$KEY_CONFIG" && \
206 
+	    chmod 0600 "$CA.key"
207 
+    else
208 
+        # Make sure CA key/cert is available
209 
+	if [ $DO_CA -eq 1 ] || [ $DO_P12 -eq 1 ]; then
210 
+	    if [ ! -r "$CA.crt" ] || [ ! -r "$CA.key" ]; then
211 
+		echo "$PROGNAME: Need a readable $CA.crt and $CA.key in $KEY_DIR"
212 
+		echo "Try $PROGNAME --initca to build a root certificate/key."
213 
+		exit 1
214 
+	    fi
215 
+	fi
216 
+
217 
+        # Build cert/key
218 
+	( [ $DO_REQ -eq 0 ] || $OPENSSL req $BATCH -days $KEY_EXPIRE $NODES_REQ -new \
219 
+	        -keyout "$KEY_CN.key" -out "$KEY_CN.csr" $REQ_EXT -config "$KEY_CONFIG" ) && \
220 
+	    ( [ $DO_CA -eq 0 ]  || $OPENSSL ca $BATCH -days $KEY_EXPIRE -out "$KEY_CN.crt" \
221 
+	        -in "$KEY_CN.csr" $CA_EXT -config "$KEY_CONFIG" ) && \
222 
+	    ( [ $DO_P12 -eq 0 ] || $OPENSSL pkcs12 -export -inkey "$KEY_CN.key" \
223 
+	        -in "$KEY_CN.crt" -certfile "$CA.crt" -out "$KEY_CN.p12" $NODES_P12 ) && \
224 
+	    ( [ $DO_CA -eq 0 ]  || chmod 0600 "$KEY_CN.key" ) && \
225 
+	    ( [ $DO_P12 -eq 0 ] || chmod 0600 "$KEY_CN.p12" )
226 
+
227 
+    fi
228 
+
229 
+# Need definitions
230 
+else
231 
+    need_vars
232 
+fi
easy-rsa/2.0/revoke-full
History View file @ 8810c26
0 233 
new file mode 100755
... ... 
@@ -0,0 +1,39 @@
0 
+#!/bin/bash
1 
+
2 
+# revoke a certificate, regenerate CRL,
3 
+# and verify revocation
4 
+
5 
+CRL="crl.pem"
6 
+RT="revoke-test.pem"
7 
+
8 
+if [ $# -ne 1 ]; then
9 
+    echo "usage: revoke-full <common-name>";
10 
+    exit 1
11 
+fi
12 
+
13 
+if [ "$KEY_DIR" ]; then
14 
+    cd "$KEY_DIR"
15 
+    rm -f "$RT"
16 
+
17 
+    # set defaults
18 
+    export KEY_CN=""
19 
+    export KEY_OU=""
20 
+
21 
+    # revoke key and generate a new CRL
22 
+    openssl ca -revoke "$1.crt" -config "$KEY_CONFIG"
23 
+
24 
+    # generate a new CRL -- try to be compatible with
25 
+    # intermediate PKIs
26 
+    openssl ca -gencrl -out "$CRL" -config "$KEY_CONFIG"
27 
+    if [ -e export-ca.crt ]; then
28 
+	cat export-ca.crt "$CRL" >"$RT"
29 
+    else
30 
+	cat ca.crt "$CRL" >"$RT"
31 
+    fi
32 
+
33 
+    # verify the revocation
34 
+    openssl verify -CAfile "$RT" -crl_check "$1.crt"
35 
+else
36 
+    echo 'Please source the vars script first (i.e. "source ./vars")'
37 
+    echo 'Make sure you have edited it to reflect your configuration.'
38 
+fi
easy-rsa/2.0/sign-req
History View file @ 8810c26
0 39 
new file mode 100755
... ... 
@@ -0,0 +1,7 @@
0 
+#!/bin/bash
1 
+
2 
+# Sign a certificate signing request (a .csr file)
3 
+# with a local root certificate and key.
4 
+
5 
+export EASY_RSA="${EASY_RSA:-.}"
6 
+"$EASY_RSA/pkitool" --interact --sign $*
easy-rsa/2.0/vars
History View file @ 8810c26
0 7 
new file mode 100755
... ... 
@@ -0,0 +1,55 @@
0 
+# easy-rsa parameter settings
1 
+
2 
+# NOTE: If you installed from an RPM,
3 
+# don't edit this file in place in
4 
+# /usr/share/openvpn/easy-rsa --
5 
+# instead, you should copy the whole
6 
+# easy-rsa directory to another location
7 
+# (such as /etc/openvpn) so that your
8 
+# edits will not be wiped out by a future
9 
+# OpenVPN package upgrade.
10 
+
11 
+# This variable should point to
12 
+# the top level of the easy-rsa
13 
+# tree.
14 
+export EASY_RSA="`pwd`"
15 
+
16 
+# This variable should point to
17 
+# the openssl.cnf file included
18 
+# with easy-rsa.
19 
+export KEY_CONFIG="$EASY_RSA/openssl.cnf"
20 
+
21 
+# Edit this variable to point to
22 
+# your soon-to-be-created key
23 
+# directory.
24 
+#
25 
+# WARNING: clean-all will do
26 
+# a rm -rf on this directory
27 
+# so make sure you define
28 
+# it correctly!
29 
+export KEY_DIR="$EASY_RSA/keys"
30 
+
31 
+# Issue rm -rf warning
32 
+echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
33 
+
34 
+# Increase this to 2048 if you
35 
+# are paranoid.  This will slow
36 
+# down TLS negotiation performance
37 
+# as well as the one-time DH parms
38 
+# generation process.
39 
+export KEY_SIZE=1024
40 
+
41 
+# In how many days should the root CA key expire?
42 
+export CA_EXPIRE=3650
43 
+
44 
+# In how many days should certificates expire?
45 
+export KEY_EXPIRE=3650
46 
+
47 
+# These are the default values for fields
48 
+# which will be placed in the certificate.
49 
+# Don't leave any of these fields blank.
50 
+export KEY_COUNTRY="US"
51 
+export KEY_PROVINCE="CA"
52 
+export KEY_CITY="SanFrancisco"
53 
+export KEY_ORG="Fort-Funston"
54 
+export KEY_EMAIL="me@myhost.mydomain"
easy-rsa/README
History View file @ 8810c26
0 55 
deleted file mode 100644
... ... 
@@ -1,168 +0,0 @@
1 
-EASY-RSA Version 2.0-rc1
2 
-
3 
-This is a small RSA key management package, based on the openssl
4 
-command line tool, that can be found in the easy-rsa subdirectory
5 
-of the OpenVPN distribution.
6 
-
7 
-These are reference notes.  For step-by-step instructions, see the
8 
-HOWTO:
9 
-
10 
-http://openvpn.net/howto.html
11 
-
12 
-This package is based on the ./pkitool script.  Run ./pkitool
13 
-without arguments for a detailed help message (which is also pasted
14 
-below).
15 
-
16 
-Release Notes for easy-rsa-2.0
17 
-
18 
-* Most functionality has been consolidated into the pkitool
19 
-  script. For compatibility, all previous scripts from 1.0 such
20 
-  as build-key and build-key-server are provided as stubs
21 
-  which call pkitool to do the real work.
22 
-
23 
-* pkitool has a --batch flag (enabled by default) which generates
24 
-  keys/certs without needing any interactive input.  pkitool
25 
-  can still generate certs/keys using interactive prompting by
26 
-  using the --interact flag.
27 
-
28 
-* The inherit-inter script has been provided for creating
29 
-  a new PKI rooted on an intermediate certificate built within a
30 
-  higher-level PKI.  See comments in the inherit-inter script
31 
-  for more info.
32 
-
33 
-* The openssl.cnf file has been modified.  pkitool will not
34 
-  work with the openssl.cnf file included with previous
35 
-  easy-rsa releases.
36 
-
37 
-* The vars file has been modified -- the following extra
38 
-  variables have been added: EASY_RSA, CA_EXPIRE,
39 
-  KEY_EXPIRE.
40 
-
41 
-* The make-crl and revoke-crt scripts have been removed and
42 
-  are replaced by the revoke-full script.
43 
-
44 
-* The "Organizational Unit" X509 field can be set using
45 
-  the KEY_OU environmental variable before calling pkitool.
46 
-
47 
-* This release only affects the Linux/Unix version of easy-rsa.
48 
-  The Windows version (written to use the Windows shell) is unchanged.
49 
-
50 
-INSTALL easy-rsa
51 
-
52 
-1. Edit vars.
53 
-2. Set KEY_CONFIG to point to the openssl.cnf file
54 
-   included in this distribution.
55 
-3. Set KEY_DIR to point to a directory which will
56 
-   contain all keys, certificates, etc.  This
57 
-   directory need not exist, and if it does,
58 
-   it will be deleted with rm -rf, so BE
59 
-   CAREFUL how you set KEY_DIR.
60 
-4. (Optional) Edit other fields in vars
61 
-   per your site data.  You may want to
62 
-   increase KEY_SIZE to 2048 if you are
63 
-   paranoid and don't mind slower key
64 
-   processing, but certainly 1024 is
65 
-   fine for testing purposes.  KEY_SIZE
66 
-   must be compatible across both peers
67 
-   participating in a secure SSL/TLS
68 
-   connection.
69 
-5  . vars
70 
-6. ./clean-all
71 
-7. As you create certificates, keys, and
72 
-   certificate signing requests, understand that
73 
-   only .key files should be kept confidential.
74 
-   .crt and .csr files can be sent over insecure
75 
-   channels such as plaintext email.
76 
-
77 
-IMPORTANT
78 
-
79 
-To avoid a possible Man-in-the-Middle attack where an authorized
80 
-client tries to connect to another client by impersonating the
81 
-server, make sure to enforce some kind of server certificate
82 
-verification by clients.  There are currently four different ways
83 
-of accomplishing this, listed in the order of preference:
84 
-
85 
-(1) Build your server certificates with the build-key-server
86 
-    script, or using the --server option to pkitool.
87 
-    This will designate the certificate as a
88 
-    server-only certificate by setting nsCertType=server.
89 
-    Now add the following line to your client configuration:
90 
-
91 
-    ns-cert-type server
92 
-
93 
-    This will block clients from connecting to any
94 
-    server which lacks the nsCertType=server designation
95 
-    in its certificate, even if the certificate has been
96 
-    signed by the CA which is cited in the OpenVPN configuration
97 
-    file (--ca directive).
98 
-
99 
-(2) Use the --tls-remote directive on the client to
100 
-    accept/reject the server connection based on the common
101 
-    name of the server certificate.
102 
-
103 
-(3) Use a --tls-verify script or plugin to accept/reject the
104 
-    server connection based on a custom test of the server
105 
-    certificate's embedded X509 subject details.
106 
-
107 
-(4) Sign server certificates with one CA and client certificates
108 
-    with a different CA.  The client config "ca" directive should
109 
-    reference the server-signing CA while the server config "ca"
110 
-    directive should reference the client-signing CA.
111 
-
112 
-NOTES
113 
-
114 
-Show certificate fields:
115 
-  openssl x509 -in cert.crt -text
116 
-
117 
-PKITOOL documentation
118 
-
119 
-pkitool 2.0
120 
-Usage: pkitool [options...] [common-name]
121 
-Options:
122 
-  --batch    : batch mode (default)
123 
-  --interact : interactive mode
124 
-  --server   : build server cert
125 
-  --initca   : build root CA
126 
-  --inter    : build intermediate CA
127 
-  --pass     : encrypt private key with password
128 
-  --csr      : only generate a CSR, do not sign
129 
-  --sign     : sign an existing CSR
130 
-  --pkcs12   : generate a combined pkcs12 file
131 
-Notes:
132 
-  Please edit the vars script to reflect your configuration,
133 
-  then source it with "source ./vars".
134 
-  Next, to start with a fresh PKI configuration and to delete any
135 
-  previous certificates and keys, run "./clean-all".
136 
-  Finally, you can run this tool (pkitool) to build certificates/keys.
137 
-Generated files and corresponding OpenVPN directives:
138 
-(Files will be placed in the $KEY_DIR directory, defined in ./vars)
139 
-  ca.crt     -> root certificate (--ca)
140 
-  ca.key     -> root key, keep secure (not directly used by OpenVPN)
141 
-  .crt files -> client/server certificates (--cert)
142 
-  .key files -> private keys, keep secure (--key)
143 
-  .csr files -> certificate signing request (not directly used by OpenVPN)
144 
-  dh1024.pem or dh2048.pem -> Diffie Hellman parameters (--dh)
145 
-Examples:
146 
-  pkitool --initca          -> Build root certificate
147 
-  pkitool --initca --pass   -> Build root certificate with password-protected key
148 
-  pkitool --server server1  -> Build "server1" certificate/key
149 
-  pkitool client1           -> Build "client1" certificate/key
150 
-  pkitool --pass client2    -> Build password-protected "client2" certificate/key
151 
-  pkitool --pkcs12 client3  -> Build "client3" certificate/key in PKCS #12 format
152 
-  pkitool --csr client4     -> Build "client4" CSR to be signed by another CA
153 
-  pkitool --sign client4    -> Sign "client4" CSR
154 
-  pkitool --inter interca   -> Build an intermediate key-signing certificate/key
155 
-                               Also see ./inherit-inter script.
156 
-Typical usage for initial PKI setup.  Build myserver, client1, and client2 cert/keys.
157 
-Protect client2 key with a password.  Build DH parms.  Generated files in ./keys :
158 
-  [edit vars with your site-specific info]
159 
-  source ./vars
160 
-  ./clean-all
161 
-  ./build-dh     -> takes a long time, consider backgrounding
162 
-  ./pkitool --initca
163 
-  ./pkitool --server myserver
164 
-  ./pkitool client1
165 
-  ./pkitool --pass client2
166 
-Typical usage for adding client cert to existing PKI:
167 
-  source ./vars
168 
-  ./pkitool client-new
easy-rsa/build-ca
History View file @ 8810c26
169 1 
deleted file mode 100755
... ... 
@@ -1,8 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-#
4 
-# Build a root certificate
5 
-#
6 
-
7 
-export EASY_RSA="${EASY_RSA:-.}"
8 
-"$EASY_RSA/pkitool" --interact --initca $*
easy-rsa/build-dh
History View file @ 8810c26
9 1 
deleted file mode 100755
... ... 
@@ -1,11 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Build Diffie-Hellman parameters for the server side
4 
-# of an SSL/TLS connection.
5 
-
6 
-if [ -d $KEY_DIR ] && [ $KEY_SIZE ]; then
7 
-    openssl dhparam -out ${KEY_DIR}/dh${KEY_SIZE}.pem ${KEY_SIZE}
8 
-else
9 
-    echo 'Please source the vars script first (i.e. "source ./vars")'
10 
-    echo 'Make sure you have edited it to reflect your configuration.'
11 
-fi
easy-rsa/build-inter
History View file @ 8810c26
12 1 
deleted file mode 100755
... ... 
@@ -1,7 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Make an intermediate CA certificate/private key pair using a locally generated
4 
-# root certificate.
5 
-
6 
-export EASY_RSA="${EASY_RSA:-.}"
7 
-"$EASY_RSA/pkitool" --interact --inter $*
easy-rsa/build-key
History View file @ 8810c26
8 1 
deleted file mode 100755
... ... 
@@ -1,7 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Make a certificate/private key pair using a locally generated
4 
-# root certificate.
5 
-
6 
-export EASY_RSA="${EASY_RSA:-.}"
7 
-"$EASY_RSA/pkitool" --interact $*
easy-rsa/build-key-pass
History View file @ 8810c26
8 1 
deleted file mode 100755
... ... 
@@ -1,7 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Similar to build-key, but protect the private key
4 
-# with a password.
5 
-
6 
-export EASY_RSA="${EASY_RSA:-.}"
7 
-"$EASY_RSA/pkitool" --interact --pass $*
easy-rsa/build-key-pkcs12
History View file @ 8810c26
8 1 
deleted file mode 100755
... ... 
@@ -1,8 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Make a certificate/private key pair using a locally generated
4 
-# root certificate and convert it to a PKCS #12 file including the
5 
-# the CA certificate as well.
6 
-
7 
-export EASY_RSA="${EASY_RSA:-.}"
8 
-"$EASY_RSA/pkitool" --interact --pkcs12 $*
easy-rsa/build-key-server
History View file @ 8810c26
9 1 
deleted file mode 100755
... ... 
@@ -1,10 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Make a certificate/private key pair using a locally generated
4 
-# root certificate.
5 
-#
6 
-# Explicitly set nsCertType to server using the "server"
7 
-# extension in the openssl.cnf file.
8 
-
9 
-export EASY_RSA="${EASY_RSA:-.}"
10 
-"$EASY_RSA/pkitool" --interact --server $*
easy-rsa/build-req
History View file @ 8810c26
11 1 
deleted file mode 100755
... ... 
@@ -1,7 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Build a certificate signing request and private key.  Use this
4 
-# when your root certificate and key is not available locally.
5 
-
6 
-export EASY_RSA="${EASY_RSA:-.}"
7 
-"$EASY_RSA/pkitool" --interact --csr $*
easy-rsa/build-req-pass
History View file @ 8810c26
8 1 
deleted file mode 100755
... ... 
@@ -1,7 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Like build-req, but protect your private key
4 
-# with a password.
5 
-
6 
-export EASY_RSA="${EASY_RSA:-.}"
7 
-"$EASY_RSA/pkitool" --interact --csr --pass $*
easy-rsa/clean-all
History View file @ 8810c26
8 1 
deleted file mode 100755
... ... 
@@ -1,16 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Initialize the $KEY_DIR directory.
4 
-# Note that this script does a
5 
-# rm -rf on $KEY_DIR so be careful!
6 
-
7 
-if [ "$KEY_DIR" ]; then
8 
-    rm -rf "$KEY_DIR"
9 
-    mkdir "$KEY_DIR" && \
10 
-	chmod go-rwx "$KEY_DIR" && \
11 
-	touch "$KEY_DIR/index.txt" && \
12 
-	echo 01 >"$KEY_DIR/serial"
13 
-else
14 
-    echo 'Please source the vars script first (i.e. "source ./vars")'
15 
-    echo 'Make sure you have edited it to reflect your configuration.'
16 
-fi
easy-rsa/inherit-inter
History View file @ 8810c26
17 1 
deleted file mode 100755
... ... 
@@ -1,39 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Build a new PKI which is rooted on an intermediate certificate generated
4 
-# by ./build-inter or ./pkitool --inter from a parent PKI.  The new PKI should
5 
-# have independent vars settings, and must use a different KEY_DIR directory
6 
-# from the parent.  This tool can be used to generate arbitrary depth
7 
-# certificate chains.
8 
-#
9 
-# To build an intermediate CA, follow the same steps for a regular PKI but
10 
-# replace ./build-key or ./pkitool --initca with this script.
11 
-
12 
-# The EXPORT_CA file will contain the CA certificate chain and should be
13 
-# referenced by the OpenVPN "ca" directive in config files.  The ca.crt file
14 
-# will only contain the local intermediate CA -- it's needed by the easy-rsa
15 
-# scripts but not by OpenVPN directly.
16 
-EXPORT_CA="export-ca.crt"
17 
-
18 
-if [ $# -ne 2 ]; then
19 
-    echo "usage: $0 <parent-key-dir> <common-name>"
20 
-    echo "parent-key-dir: the KEY_DIR directory of the parent PKI"
21 
-    echo "common-name: the common name of the intermediate certificate in the parent PKI"
22 
-    exit 1;
23 
-fi
24 
-
25 
-if [ "$KEY_DIR" ]; then
26 
-    cp "$1/$2.crt" "$KEY_DIR/ca.crt"
27 
-    cp "$1/$2.key" "$KEY_DIR/ca.key"
28 
-
29 
-    if [ -e "$1/$EXPORT_CA" ]; then
30 
-	PARENT_CA="$1/$EXPORT_CA"
31 
-    else
32 
-	PARENT_CA="$1/ca.crt"
33 
-    fi
34 
-    cp "$PARENT_CA" "$KEY_DIR/$EXPORT_CA"
35 
-    cat "$KEY_DIR/ca.crt" >> "$KEY_DIR/$EXPORT_CA"
36 
-else
37 
-    echo 'Please source the vars script first (i.e. "source ./vars")'
38 
-    echo 'Make sure you have edited it to reflect your configuration.'
39 
-fi
easy-rsa/list-crl
History View file @ 8810c26
40 1 
deleted file mode 100755
... ... 
@@ -1,13 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# list revoked certificates
4 
-
5 
-CRL="${1:-crl.pem}"
6 
-
7 
-if [ "$KEY_DIR" ]; then
8 
-    cd "$KEY_DIR" && \
9 
-	openssl crl -text -noout -in "$CRL"
10 
-else
11 
-    echo 'Please source the vars script first (i.e. "source ./vars")'
12 
-    echo 'Make sure you have edited it to reflect your configuration.'
13 
-fi
easy-rsa/openssl.cnf
History View file @ 8810c26
14 1 
deleted file mode 100755
... ... 
@@ -1,261 +0,0 @@
1 
-# For use with easy-rsa version 2.0
2 
-
3 
-#
4 
-# OpenSSL example configuration file.
5 
-# This is mostly being used for generation of certificate requests.
6 
-#
7 
-
8 
-# This definition stops the following lines choking if HOME isn't
9 
-# defined.
10 
-HOME			= .
11 
-RANDFILE		= $ENV::HOME/.rnd
12 
-
13 
-# Extra OBJECT IDENTIFIER info:
14 
-#oid_file		= $ENV::HOME/.oid
15 
-oid_section		= new_oids
16 
-
17 
-# To use this configuration file with the "-extfile" option of the
18 
-# "openssl x509" utility, name here the section containing the
19 
-# X.509v3 extensions to use:
20 
-# extensions		=
21 
-# (Alternatively, use a configuration file that has only
22 
-# X.509v3 extensions in its main [= default] section.)
23 
-
24 
-[ new_oids ]
25 
-
26 
-# We can add new OIDs in here for use by 'ca' and 'req'.
27 
-# Add a simple OID like this:
28 
-# testoid1=1.2.3.4
29 
-# Or use config file substitution like this:
30 
-# testoid2=${testoid1}.5.6
31 
-
32 
-####################################################################
33 
-[ ca ]
34 
-default_ca	= CA_default		# The default ca section
35 
-
36 
-####################################################################
37 
-[ CA_default ]
38 
-
39 
-dir		= $ENV::KEY_DIR		# Where everything is kept
40 
-certs		= $dir			# Where the issued certs are kept
41 
-crl_dir		= $dir			# Where the issued crl are kept
42 
-database	= $dir/index.txt	# database index file.
43 
-new_certs_dir	= $dir			# default place for new certs.
44 
-
45 
-certificate	= $dir/ca.crt	 	# The CA certificate
46 
-serial		= $dir/serial 		# The current serial number
47 
-crl		= $dir/crl.pem 		# The current CRL
48 
-private_key	= $dir/ca.key	 	# The private key
49 
-RANDFILE	= $dir/.rand		# private random number file
50 
-
51 
-x509_extensions	= usr_cert		# The extentions to add to the cert
52 
-
53 
-# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
54 
-# so this is commented out by default to leave a V1 CRL.
55 
-# crl_extensions	= crl_ext
56 
-
57 
-default_days	= 3650			# how long to certify for
58 
-default_crl_days= 30			# how long before next CRL
59 
-default_md	= md5			# which md to use.
60 
-preserve	= no			# keep passed DN ordering
61 
-
62 
-# A few difference way of specifying how similar the request should look
63 
-# For type CA, the listed attributes must be the same, and the optional
64 
-# and supplied fields are just that :-)
65 
-policy		= policy_anything
66 
-
67 
-# For the CA policy
68 
-[ policy_match ]
69 
-countryName		= match
70 
-stateOrProvinceName	= match
71 
-organizationName	= match
72 
-organizationalUnitName	= optional
73 
-commonName		= supplied
74 
-emailAddress		= optional
75 
-
76 
-# For the 'anything' policy
77 
-# At this point in time, you must list all acceptable 'object'
78 
-# types.
79 
-[ policy_anything ]
80 
-countryName		= optional
81 
-stateOrProvinceName	= optional
82 
-localityName		= optional
83 
-organizationName	= optional
84 
-organizationalUnitName	= optional
85 
-commonName		= supplied
86 
-emailAddress		= optional
87 
-
88 
-####################################################################
89 
-[ req ]
90 
-default_bits		= $ENV::KEY_SIZE
91 
-default_keyfile 	= privkey.pem
92 
-distinguished_name	= req_distinguished_name
93 
-attributes		= req_attributes
94 
-x509_extensions	= v3_ca	# The extentions to add to the self signed cert
95 
-
96 
-# Passwords for private keys if not present they will be prompted for
97 
-# input_password = secret
98 
-# output_password = secret
99 
-
100 
-# This sets a mask for permitted string types. There are several options.
101 
-# default: PrintableString, T61String, BMPString.
102 
-# pkix	 : PrintableString, BMPString.
103 
-# utf8only: only UTF8Strings.
104 
-# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
105 
-# MASK:XXXX a literal mask value.
106 
-# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
107 
-# so use this option with caution!
108 
-string_mask = nombstr
109 
-
110 
-# req_extensions = v3_req # The extensions to add to a certificate request
111 
-
112 
-[ req_distinguished_name ]
113 
-countryName			= Country Name (2 letter code)
114 
-countryName_default		= $ENV::KEY_COUNTRY
115 
-countryName_min			= 2
116 
-countryName_max			= 2
117 
-
118 
-stateOrProvinceName		= State or Province Name (full name)
119 
-stateOrProvinceName_default	= $ENV::KEY_PROVINCE
120 
-
121 
-localityName			= Locality Name (eg, city)
122 
-localityName_default		= $ENV::KEY_CITY
123 
-
124 
-0.organizationName		= Organization Name (eg, company)
125 
-0.organizationName_default	= $ENV::KEY_ORG
126 
-
127 
-# we can do this but it is not needed normally :-)
128 
-#1.organizationName		= Second Organization Name (eg, company)
129 
-#1.organizationName_default	= World Wide Web Pty Ltd
130 
-
131 
-organizationalUnitName		= Organizational Unit Name (eg, section)
132 
-#organizationalUnitName_default	=
133 
-
134 
-commonName			= Common Name (eg, your name or your server\'s hostname)
135 
-commonName_max			= 64
136 
-
137 
-emailAddress			= Email Address
138 
-emailAddress_default		= $ENV::KEY_EMAIL
139 
-emailAddress_max		= 40
140 
-
141 
-# JY -- added for batch mode
142 
-organizationalUnitName_default = $ENV::KEY_OU
143 
-commonName_default = $ENV::KEY_CN
144 
-
145 
-# SET-ex3			= SET extension number 3
146 
-
147 
-[ req_attributes ]
148 
-challengePassword		= A challenge password
149 
-challengePassword_min		= 4
150 
-challengePassword_max		= 20
151 
-
152 
-unstructuredName		= An optional company name
153 
-
154 
-[ usr_cert ]
155 
-
156 
-# These extensions are added when 'ca' signs a request.
157 
-
158 
-# This goes against PKIX guidelines but some CAs do it and some software
159 
-# requires this to avoid interpreting an end user certificate as a CA.
160 
-
161 
-basicConstraints=CA:FALSE
162 
-
163 
-# Here are some examples of the usage of nsCertType. If it is omitted
164 
-# the certificate can be used for anything *except* object signing.
165 
-
166 
-# This is OK for an SSL server.
167 
-# nsCertType			= server
168 
-
169 
-# For an object signing certificate this would be used.
170 
-# nsCertType = objsign
171 
-
172 
-# For normal client use this is typical
173 
-# nsCertType = client, email
174 
-
175 
-# and for everything including object signing:
176 
-# nsCertType = client, email, objsign
177 
-
178 
-# This is typical in keyUsage for a client certificate.
179 
-# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
180 
-
181 
-# This will be displayed in Netscape's comment listbox.
182 
-nsComment			= "OpenSSL Generated Certificate"
183 
-
184 
-# PKIX recommendations harmless if included in all certificates.
185 
-subjectKeyIdentifier=hash
186 
-authorityKeyIdentifier=keyid,issuer:always
187 
-
188 
-# This stuff is for subjectAltName and issuerAltname.
189 
-# Import the email address.
190 
-# subjectAltName=email:copy
191 
-
192 
-# Copy subject details
193 
-# issuerAltName=issuer:copy
194 
-
195 
-#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
196 
-#nsBaseUrl
197 
-#nsRevocationUrl
198 
-#nsRenewalUrl
199 
-#nsCaPolicyUrl
200 
-#nsSslServerName
201 
-
202 
-[ server ]
203 
-
204 
-# JY ADDED -- Make a cert with nsCertType set to "server"
205 
-basicConstraints=CA:FALSE
206 
-nsCertType			= server
207 
-nsComment			= "OpenSSL Generated Server Certificate"
208 
-subjectKeyIdentifier=hash
209 
-authorityKeyIdentifier=keyid,issuer:always
210 
-
211 
-[ v3_req ]
212 
-
213 
-# Extensions to add to a certificate request
214 
-
215 
-basicConstraints = CA:FALSE
216 
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
217 
-
218 
-[ v3_ca ]
219 
-
220 
-
221 
-# Extensions for a typical CA
222 
-
223 
-
224 
-# PKIX recommendation.
225 
-
226 
-subjectKeyIdentifier=hash
227 
-
228 
-authorityKeyIdentifier=keyid:always,issuer:always
229 
-
230 
-# This is what PKIX recommends but some broken software chokes on critical
231 
-# extensions.
232 
-#basicConstraints = critical,CA:true
233 
-# So we do this instead.
234 
-basicConstraints = CA:true
235 
-
236 
-# Key usage: this is typical for a CA certificate. However since it will
237 
-# prevent it being used as an test self-signed certificate it is best
238 
-# left out by default.
239 
-# keyUsage = cRLSign, keyCertSign
240 
-
241 
-# Some might want this also
242 
-# nsCertType = sslCA, emailCA
243 
-
244 
-# Include email address in subject alt name: another PKIX recommendation
245 
-# subjectAltName=email:copy
246 
-# Copy issuer details
247 
-# issuerAltName=issuer:copy
248 
-
249 
-# DER hex encoding of an extension: beware experts only!
250 
-# obj=DER:02:03
251 
-# Where 'obj' is a standard or added object
252 
-# You can even override a supported extension:
253 
-# basicConstraints= critical, DER:30:03:01:01:FF
254 
-
255 
-[ crl_ext ]
256 
-
257 
-# CRL extensions.
258 
-# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
259 
-
260 
-# issuerAltName=issuer:copy
261 
-authorityKeyIdentifier=keyid:always,issuer:always
easy-rsa/pkitool
History View file @ 8810c26
262 1 
deleted file mode 100755
... ... 
@@ -1,233 +0,0 @@
1 
-#!/bin/sh
2 
-
3 
-#  OpenVPN -- An application to securely tunnel IP networks
4 
-#             over a single TCP/UDP port, with support for SSL/TLS-based
5 
-#             session authentication and key exchange,
6 
-#             packet encryption, packet authentication, and
7 
-#             packet compression.
8 
-#
9 
-#  Copyright (C) 2002-2005 OpenVPN Solutions LLC <info@openvpn.net>
10 
-#
11 
-#  This program is free software; you can redistribute it and/or modify
12 
-#  it under the terms of the GNU General Public License version 2
13 
-#  as published by the Free Software Foundation.
14 
-#
15 
-#  This program is distributed in the hope that it will be useful,
16 
-#  but WITHOUT ANY WARRANTY; without even the implied warranty of
17 
-#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18 
-#  GNU General Public License for more details.
19 
-#
20 
-#  You should have received a copy of the GNU General Public License
21 
-#  along with this program (see the file COPYING included with this
22 
-#  distribution); if not, write to the Free Software Foundation, Inc.,
23 
-#  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
24 
-
25 
-# pkitool is a front-end for the openssl tool.
26 
-
27 
-# Calling scripts can set the certificate organizational
28 
-# unit with the KEY_OU environmental variable.
29 
-
30 
-PROGNAME=pkitool
31 
-VERSION=2.0
32 
-DEBUG=0
33 
-
34 
-GREP=grep
35 
-OPENSSL=openssl
36 
-
37 
-need_vars()
38 
-{
39 
-    echo '  Please edit the vars script to reflect your configuration,'
40 
-    echo '  then source it with "source ./vars".'
41 
-    echo '  Next, to start with a fresh PKI configuration and to delete any'
42 
-    echo '  previous certificates and keys, run "./clean-all".'
43 
-    echo "  Finally, you can run this tool ($PROGNAME) to build certificates/keys."
44 
-}
45 
-
46 
-usage()
47 
-{
48 
-    echo "$PROGNAME $VERSION"
49 
-    echo "Usage: $PROGNAME [options...] [common-name]"
50 
-    echo "Options:"
51 
-    echo "  --batch    : batch mode (default)"
52 
-    echo "  --interact : interactive mode"
53 
-    echo "  --server   : build server cert"
54 
-    echo "  --initca   : build root CA"
55 
-    echo "  --inter    : build intermediate CA"
56 
-    echo "  --pass     : encrypt private key with password"
57 
-    echo "  --csr      : only generate a CSR, do not sign"
58 
-    echo "  --sign     : sign an existing CSR"
59 
-    echo "  --pkcs12   : generate a combined pkcs12 file"
60 
-    echo "Notes:"
61 
-    need_vars
62 
-    echo "Generated files and corresponding OpenVPN directives:"
63 
-    echo '(Files will be placed in the $KEY_DIR directory, defined in ./vars)'
64 
-    echo "  ca.crt     -> root certificate (--ca)"
65 
-    echo "  ca.key     -> root key, keep secure (not directly used by OpenVPN)"
66 
-    echo "  .crt files -> client/server certificates (--cert)"
67 
-    echo "  .key files -> private keys, keep secure (--key)"
68 
-    echo "  .csr files -> certificate signing request (not directly used by OpenVPN)"
69 
-    echo "  dh1024.pem or dh2048.pem -> Diffie Hellman parameters (--dh)"
70 
-    echo "Examples:"
71 
-    echo "  $PROGNAME --initca          -> Build root certificate"
72 
-    echo "  $PROGNAME --initca --pass   -> Build root certificate with password-protected key"
73 
-    echo "  $PROGNAME --server server1  -> Build \"server1\" certificate/key"
74 
-    echo "  $PROGNAME client1           -> Build \"client1\" certificate/key"
75 
-    echo "  $PROGNAME --pass client2    -> Build password-protected \"client2\" certificate/key"
76 
-    echo "  $PROGNAME --pkcs12 client3  -> Build \"client3\" certificate/key in PKCS #12 format"
77 
-    echo "  $PROGNAME --csr client4     -> Build \"client4\" CSR to be signed by another CA"
78 
-    echo "  $PROGNAME --sign client4    -> Sign \"client4\" CSR"
79 
-    echo "  $PROGNAME --inter interca   -> Build an intermediate key-signing certificate/key"
80 
-    echo "                               Also see ./inherit-inter script."
81 
-    echo "Typical usage for initial PKI setup.  Build myserver, client1, and client2 cert/keys."
82 
-    echo "Protect client2 key with a password.  Build DH parms.  Generated files in ./keys :"
83 
-    echo "  [edit vars with your site-specific info]"
84 
-    echo "  source ./vars"
85 
-    echo "  ./clean-all"
86 
-    echo "  ./build-dh     -> takes a long time, consider backgrounding"
87 
-    echo "  ./$PROGNAME --initca"
88 
-    echo "  ./$PROGNAME --server myserver"
89 
-    echo "  ./$PROGNAME client1"
90 
-    echo "  ./$PROGNAME --pass client2"
91 
-    echo "Typical usage for adding client cert to existing PKI:"
92 
-    echo "  source ./vars"
93 
-    echo "  ./$PROGNAME client-new"
94 
-}
95 
-
96 
-# Set defaults
97 
-DO_REQ="1"
98 
-REQ_EXT=""
99 
-DO_CA="1"
100 
-CA_EXT=""
101 
-DO_P12="0"
102 
-DO_ROOT="0"
103 
-NODES_REQ="-nodes"
104 
-NODES_P12=""
105 
-BATCH="-batch"
106 
-CA="ca"
107 
-
108 
-# Process options
109 
-while [ $# -gt 0 ]; do
110 
-    case "$1" in
111 
-	--server   ) REQ_EXT="$REQ_EXT -extensions server"
112 
-	             CA_EXT="$CA_EXT -extensions server" ;;
113 
-	--batch    ) BATCH="-batch" ;;
114 
-	--interact ) BATCH="" ;;
115 
-        --inter    ) CA_EXT="$CA_EXT -extensions v3_ca" ;;
116 
-        --initca   ) DO_ROOT="1" ;;
117 
-	--pass     ) NODES_REQ="" ;;
118 
-        --csr      ) DO_CA="0" ;;
119 
-        --sign     ) DO_REQ="0" ;;
120 
-        --pkcs12   ) DO_P12="1" ;;
121 
-	--*        ) echo "$PROGNAME: unknown option: $1"
122 
-	             exit 1 ;;
123 
-	*          ) break ;;
124 
-    esac
125 
-    shift
126 
-done
127 
-
128 
-# If we are generating pkcs12, only encrypt the final step
129 
-if [ $DO_P12 -eq 1 ]; then
130 
-    NODES_P12="$NODES_REQ"
131 
-    NODES_REQ="-nodes"
132 
-fi
133 
-
134 
-# If undefined, set default key expiration intervals
135 
-if [ -z "$KEY_EXPIRE" ]; then
136 
-    KEY_EXPIRE=3650
137 
-fi
138 
-if [ -z "$CA_EXPIRE" ]; then
139 
-    CA_EXPIRE=3650
140 
-fi
141 
-
142 
-# Set organizational unit to empty string if undefined
143 
-if [ -z "$KEY_OU" ]; then
144 
-    KEY_OU=""
145 
-fi
146 
-
147 
-# Set KEY_CN
148 
-if [ $DO_ROOT -eq 1 ]; then
149 
-    if [ -z "$KEY_CN" ]; then
150 
-	if [ "$1" ]; then
151 
-	    KEY_CN="$1"
152 
-	elif [ "$KEY_ORG" ]; then
153 
-	    KEY_CN="$KEY_ORG CA"
154 
-	fi
155 
-    fi
156 
-    if [ $BATCH ] && [ "$KEY_CN" ]; then
157 
-	echo "Using CA Common Name:" $KEY_CN
158 
-    fi
159 
-elif [ $BATCH ] && [ "$KEY_CN" ] && [ $# -eq 0 ]; then
160 
-    echo "Using Common Name:" $KEY_CN
161 
-else
162 
-    if [ $# -ne 1 ]; then
163 
-	usage
164 
-	exit 1
165 
-    else
166 
-	KEY_CN="$1"
167 
-    fi
168 
-fi
169 
-export CA_EXPIRE KEY_EXPIRE KEY_OU KEY_CN
170 
-
171 
-# Show parameters (debugging)
172 
-if [ $DEBUG -eq 1 ]; then
173 
-    echo DO_REQ $DO_REQ
174 
-    echo REQ_EXT $REQ_EXT
175 
-    echo DO_CA $DO_CA
176 
-    echo CA_EXT $CA_EXT
177 
-    echo NODES_REQ $NODES_REQ
178 
-    echo NODES_P12 $NODES_P12
179 
-    echo DO_P12 $DO_P12
180 
-    echo KEY_CN $KEY_CN
181 
-    echo BATCH $BATCH
182 
-    echo DO_ROOT $DO_ROOT
183 
-    echo KEY_EXPIRE $KEY_EXPIRE
184 
-    echo CA_EXPIRE $CA_EXPIRE
185 
-    echo KEY_OU $KEY_OU
186 
-fi
187 
-
188 
-# Make sure ./vars was sourced beforehand
189 
-if [ -d "$KEY_DIR" ] && [ "$KEY_CONFIG" ]; then
190 
-    cd "$KEY_DIR"
191 
-
192 
-    # Make sure $KEY_CONFIG points to the correct version
193 
-    # of openssl.cnf
194 
-    if $GREP -i 'easy-rsa version 2\.[0-9]' "$KEY_CONFIG" >/dev/null; then
195 
-	:
196 
-    else
197 
-	echo "$PROGNAME: KEY_CONFIG (set by the ./vars script) is pointing to the wrong"
198 
-        echo "version of openssl.cnf: $KEY_CONFIG"
199 
-	echo "The correct version should have a comment that says: easy-rsa version 2.x";
200 
-	exit 1;
201 
-    fi
202 
-
203 
-    # Build root CA
204 
-    if [ $DO_ROOT -eq 1 ]; then
205 
-	$OPENSSL req $BATCH -days $CA_EXPIRE $NODES_REQ -new -x509 \
206 
-	    -keyout "$CA.key" -out "$CA.crt" -config "$KEY_CONFIG" && \
207 
-	    chmod 0600 "$CA.key"
208 
-    else
209 
-        # Make sure CA key/cert is available
210 
-	if [ $DO_CA -eq 1 ] || [ $DO_P12 -eq 1 ]; then
211 
-	    if [ ! -r "$CA.crt" ] || [ ! -r "$CA.key" ]; then
212 
-		echo "$PROGNAME: Need a readable $CA.crt and $CA.key in $KEY_DIR"
213 
-		echo "Try $PROGNAME --initca to build a root certificate/key."
214 
-		exit 1
215 
-	    fi
216 
-	fi
217 
-
218 
-        # Build cert/key
219 
-	( [ $DO_REQ -eq 0 ] || $OPENSSL req $BATCH -days $KEY_EXPIRE $NODES_REQ -new \
220 
-	        -keyout "$KEY_CN.key" -out "$KEY_CN.csr" $REQ_EXT -config "$KEY_CONFIG" ) && \
221 
-	    ( [ $DO_CA -eq 0 ]  || $OPENSSL ca $BATCH -days $KEY_EXPIRE -out "$KEY_CN.crt" \
222 
-	        -in "$KEY_CN.csr" $CA_EXT -config "$KEY_CONFIG" ) && \
223 
-	    ( [ $DO_P12 -eq 0 ] || $OPENSSL pkcs12 -export -inkey "$KEY_CN.key" \
224 
-	        -in "$KEY_CN.crt" -certfile "$CA.crt" -out "$KEY_CN.p12" $NODES_P12 ) && \
225 
-	    ( [ $DO_CA -eq 0 ]  || chmod 0600 "$KEY_CN.key" ) && \
226 
-	    ( [ $DO_P12 -eq 0 ] || chmod 0600 "$KEY_CN.p12" )
227 
-
228 
-    fi
229 
-
230 
-# Need definitions
231 
-else
232 
-    need_vars
233 
-fi
easy-rsa/revoke-full
History View file @ 8810c26
234 1 
deleted file mode 100755
... ... 
@@ -1,39 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# revoke a certificate, regenerate CRL,
4 
-# and verify revocation
5 
-
6 
-CRL="crl.pem"
7 
-RT="revoke-test.pem"
8 
-
9 
-if [ $# -ne 1 ]; then
10 
-    echo "usage: revoke-full <common-name>";
11 
-    exit 1
12 
-fi
13 
-
14 
-if [ "$KEY_DIR" ]; then
15 
-    cd "$KEY_DIR"
16 
-    rm -f "$RT"
17 
-
18 
-    # set defaults
19 
-    export KEY_CN=""
20 
-    export KEY_OU=""
21 
-
22 
-    # revoke key and generate a new CRL
23 
-    openssl ca -revoke "$1.crt" -config "$KEY_CONFIG"
24 
-
25 
-    # generate a new CRL -- try to be compatible with
26 
-    # intermediate PKIs
27 
-    openssl ca -gencrl -out "$CRL" -config "$KEY_CONFIG"
28 
-    if [ -e export-ca.crt ]; then
29 
-	cat export-ca.crt "$CRL" >"$RT"
30 
-    else
31 
-	cat ca.crt "$CRL" >"$RT"
32 
-    fi
33 
-
34 
-    # verify the revocation
35 
-    openssl verify -CAfile "$RT" -crl_check "$1.crt"
36 
-else
37 
-    echo 'Please source the vars script first (i.e. "source ./vars")'
38 
-    echo 'Make sure you have edited it to reflect your configuration.'
39 
-fi
easy-rsa/sign-req
History View file @ 8810c26
40 1 
deleted file mode 100755
... ... 
@@ -1,7 +0,0 @@
1 
-#!/bin/bash
2 
-
3 
-# Sign a certificate signing request (a .csr file)
4 
-# with a local root certificate and key.
5 
-
6 
-export EASY_RSA="${EASY_RSA:-.}"
7 
-"$EASY_RSA/pkitool" --interact --sign $*
easy-rsa/vars
History View file @ 8810c26
8 1 
deleted file mode 100755
... ... 
@@ -1,55 +0,0 @@
1 
-# easy-rsa parameter settings
2 
-
3 
-# NOTE: If you installed from an RPM,
4 
-# don't edit this file in place in
5 
-# /usr/share/openvpn/easy-rsa --
6 
-# instead, you should copy the whole
7 
-# easy-rsa directory to another location
8 
-# (such as /etc/openvpn) so that your
9 
-# edits will not be wiped out by a future
10 
-# OpenVPN package upgrade.
11 
-
12 
-# This variable should point to
13 
-# the top level of the easy-rsa
14 
-# tree.
15 
-export EASY_RSA="`pwd`"
16 
-
17 
-# This variable should point to
18 
-# the openssl.cnf file included
19 
-# with easy-rsa.
20 
-export KEY_CONFIG="$EASY_RSA/openssl.cnf"
21 
-
22 
-# Edit this variable to point to
23 
-# your soon-to-be-created key
24 
-# directory.
25 
-#
26 
-# WARNING: clean-all will do
27 
-# a rm -rf on this directory
28 
-# so make sure you define
29 
-# it correctly!
30 
-export KEY_DIR="$EASY_RSA/keys"
31 
-
32 
-# Issue rm -rf warning
33 
-echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
34 
-
35 
-# Increase this to 2048 if you
36 
-# are paranoid.  This will slow
37 
-# down TLS negotiation performance
38 
-# as well as the one-time DH parms
39 
-# generation process.
40 
-export KEY_SIZE=1024
41 
-
42 
-# In how many days should the root CA key expire?
43 
-export CA_EXPIRE=3650
44 
-
45 
-# In how many days should certificates expire?
46 
-export KEY_EXPIRE=3650
47 
-
48 
-# These are the default values for fields
49 
-# which will be placed in the certificate.
50 
-# Don't leave any of these fields blank.
51 
-export KEY_COUNTRY="US"
52 
-export KEY_PROVINCE="CA"
53 
-export KEY_CITY="SanFrancisco"
54 
-export KEY_ORG="Fort-Funston"
55 
-export KEY_EMAIL="me@myhost.mydomain"