Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

self-sign: Allow Edwards Curve based keys #1197

Merged
merged 2 commits into from
Aug 2, 2024
Merged

self-sign: Allow Edwards Curve based keys #1197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
81b749b
self-sign: Allow Edwards Curve based keys
TinCanTech Aug 1, 2024
f7d8274
ChangeLog: self-sign, allow Edwards Curve based keys
TinCanTech Aug 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ChangeLog
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ Easy-RSA 3 ChangeLog

3.2.1 (TBD)

* self-sign: Allow Edwards Curve based keys (81b749b) (#1197)
* Re-enable command 'renew' (version 2): Requires EasyRSA Tools (30fe311) (#1195)
* bug-fix: revoke: Pass the correct certificate location (24d5514)
* vars.example: Add flags for auto-SAN and X509 critical attribute (a41dfcc)
Expand Down
42 changes: 23 additions & 19 deletions easyrsa3/easyrsa
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1972,24 +1972,36 @@ Conflicting certificate exists at:

# Check algo and curve
case "$EASYRSA_ALGO" in
rsa)
# Silently use ec
rsa|ec)
# Silently use ec instead of rsa
export EASYRSA_ALGO=ec
# Selectively set --curve=secp384r1
set_var EASYRSA_CURVE secp384r1
;;
ec)
: # ok

# temp-file for params-file
selfsign_params_file=""
easyrsa_mktemp selfsign_params_file || \
die "self_sign - easyrsa_mktemp selfsign_params_file"

# params-file
"$EASYRSA_OPENSSL" ecparam \
-name "$EASYRSA_CURVE" \
-out "$selfsign_params_file" || \
die "self_sign - params-file failed"

newkey_params="$EASYRSA_ALGO":"$selfsign_params_file"
;;
ed)
user_error "self-sign does not support ED Curves."
# Selectively set --curve=ed25519
set_var EASYRSA_CURVE ed25519
newkey_params="$EASYRSA_CURVE"
;;
*)
user_error "Unrecognised algorithm: '$EASYRSA_ALGO'"
esac

verbose "\
self-sign: Use ALGO/CURVE to $EASYRSA_ALGO/$EASYRSA_CURVE"
self-sign: Use ALGO:'$EASYRSA_ALGO' / CURVE:'$EASYRSA_CURVE'"

# Assign tmp-file for config
adjusted_ssl_cnf_tmp=""
Expand Down Expand Up @@ -2041,17 +2053,6 @@ self-sign: Use ALGO/CURVE to $EASYRSA_ALGO/$EASYRSA_CURVE"
# Use this new SSL config for the rest of this function
EASYRSA_SSL_CONF="$adjusted_ssl_cnf_tmp"

# temp-file for params-file
selfsign_params_file=""
easyrsa_mktemp selfsign_params_file || \
die "self_sign - easyrsa_mktemp selfsign_params_file"

# params-file
"$EASYRSA_OPENSSL" ecparam \
-name "$EASYRSA_CURVE" \
-out "$selfsign_params_file" || \
die "self_sign - params-file failed"

# Create temp-files for output
tmp_key_out=""
easyrsa_mktemp tmp_key_out || \
Expand All @@ -2063,7 +2064,7 @@ self-sign: Use ALGO/CURVE to $EASYRSA_ALGO/$EASYRSA_CURVE"

# create self-signed key pair
easyrsa_openssl req -x509 -utf8 -sha256 -text \
-newkey "$EASYRSA_ALGO":"$selfsign_params_file" \
-newkey "$newkey_params" \
-keyout "$tmp_key_out" \
-out "$tmp_crt_out" \
-subj "/CN=$file_name_base" \
Expand Down Expand Up @@ -5803,6 +5804,9 @@ case "$cmd" in
export EASYRSA_CERT_EXPIRE="$alias_days"
self_sign client "$@"
;;
self*)
user_error "Self-sign syntax example: 'self-sign-server foo'"
;;
gen-dh)
verify_working_env
gen_dh
Expand Down