Skip to content

Commit 58f4130

Browse files
ValantinValantin
committed
Support new EasyRSA 3 set_vars
1 parent 553b735 commit 58f4130

File tree

2 files changed

+224
-77
lines changed

2 files changed

+224
-77
lines changed

‎manifests/client.pp

+1-1
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@
116116
case $openvpn::easyrsa_version {
117117
'3.0': {
118118
exec { "generate certificate for ${name} in context of ${ca_name}":
119-
command => ". ./vars && ${env_expire} ./easyrsa --batch build-client-full ${name} nopass",
119+
command => "${env_expire} ./easyrsa --batch build-client-full ${name} nopass",
120120
cwd => "${server_directory}/${ca_name}/easy-rsa",
121121
creates => "${server_directory}/${ca_name}/easy-rsa/keys/issued/${name}.crt",
122122
provider => 'shell';

‎templates/vars-30.epp

+223-76
Original file line numberDiff line numberDiff line change
@@ -1,109 +1,256 @@
1-
# easy-rsa parameter settings
1+
# Easy-RSA 3 parameter settings
22

3-
# NOTE: If you installed from an RPM,
4-
# don't edit this file in place in
5-
# /usr/share/openvpn/easy-rsa --
6-
# instead, you should copy the whole
7-
# easy-rsa directory to another location
8-
# (such as /etc/openvpn) so that your
9-
# edits will not be wiped out by a future
10-
# OpenVPN package upgrade.
3+
# NOTE: If you installed Easy-RSA from your package manager, do not edit
4+
# this file in place -- instead, you should copy the entire easy-rsa directory
5+
# to another location so future upgrades do not wipe out your changes.
116

12-
# This variable should point to
13-
# the top level of the easy-rsa
14-
# tree.
15-
export EASY_RSA="<%= $server_directory -%>/<%= $openvpn_server %>/easy-rsa"
7+
# HOW TO USE THIS FILE
8+
#
9+
# vars.example contains built-in examples to Easy-RSA settings. You MUST name
10+
# this file "vars" if you want it to be used as a configuration file. If you
11+
# do not, it WILL NOT be automatically read when you call easyrsa commands.
12+
#
13+
# It is not necessary to use this config file unless you wish to change
14+
# operational defaults. These defaults should be fine for many uses without
15+
# the need to copy and edit the "vars" file.
16+
#
17+
# All of the editable settings are shown commented and start with the command
18+
# "set_var" -- this means any set_var command that is uncommented has been
19+
# modified by the user. If you are happy with a default, there is no need to
20+
# define the value to its default.
1621

22+
# NOTES FOR WINDOWS USERS
1723
#
18-
# This variable should point to
19-
# the requested executables
24+
# Paths for Windows *MUST* use forward slashes, or optionally double-escaped
25+
# backslashes (single forward slashes are recommended.) This means your path
26+
# to the openssl binary might look like this:
27+
# "C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
28+
29+
# A little housekeeping: DO NOT EDIT THIS SECTION
2030
#
21-
export EASYRSA_OPENSSL="openssl"
22-
export PKCS11TOOL="pkcs11-tool"
23-
export GREP="grep"
31+
# Easy-RSA 3.x does not source into the environment directly.
32+
# Complain if a user tries to do this:
33+
if [ -z "$EASYRSA_CALLER" ]; then
34+
echo "You appear to be sourcing an Easy-RSA *vars* file. This is" >&2
35+
echo "no longer necessary and is disallowed. See the section called" >&2
36+
echo "*How to use this file* near the top comments for more details." >&2
37+
return 1
38+
fi
2439

40+
# DO YOUR EDITS BELOW THIS POINT
2541

26-
# This variable should point to
27-
# the openssl.cnf file included
28-
# with easy-rsa.
29-
export EASYRSA_SSL_CONF="$EASY_RSA/openssl-1.0.cnf"
42+
# This variable is used as the base location of configuration files needed by
43+
# easyrsa. More specific variables for specific files (eg: EASYRSA_SSL_CONF)
44+
# may override this default.
45+
#
46+
# The default value of this variable is the location of the easyrsa script
47+
# itself, which is also where the configuration files are located in the
48+
# easy-rsa tree.
49+
#
50+
set_var EASYRSA "<%= $server_directory -%>/<%= $openvpn_server %>/easy-rsa"
3051

31-
# Edit this variable to point to
32-
# your soon-to-be-created key
33-
# directory.
52+
set_var EASYRSA_PKI "$EASYRSA/keys"
53+
54+
# If your OpenSSL command is not in the system PATH, you will need to define
55+
# the path here. Normally this means a full path to the executable, otherwise
56+
# you could have left it undefined here and the shown default would be used.
57+
#
58+
# Windows users, remember to use paths with forward-slashes (or escaped
59+
# back-slashes.) Windows users should declare the full path to the openssl
60+
# binary here if it is not in their system PATH.
61+
#
62+
set_var EASYRSA_OPENSSL "openssl"
3463
#
35-
# WARNING: clean-all will do
36-
# a rm -rf on this directory
37-
# so make sure you define
38-
# it correctly!
39-
export EASYRSA_PKI="$EASY_RSA/keys"
64+
# This sample is in Windows syntax -- edit it for your path if not using PATH:
65+
#set_var EASYRSA_OPENSSL "C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
4066

41-
# Issue rm -rf warning
42-
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $EASYRSA_PKI
67+
# Define X509 DN mode.
68+
#
69+
# This is used to adjust which elements are included in the Subject field
70+
# as the DN ("Distinguished Name"). Note that in 'cn_only' mode the
71+
# Organizational fields, listed further below, are not used.
72+
#
73+
# Choices are:
74+
# cn_only - Use just a commonName value.
75+
# org - Use the "traditional" format:
76+
# Country/Province/City/Org/Org.Unit/email/commonName
77+
#
78+
set_var EASYRSA_DN "<%= $dn_mode %>"
4379

44-
# PKCS11 fixes
45-
export PKCS11_MODULE_PATH="dummy"
46-
export PKCS11_PIN="dummy"
80+
# Organizational fields (used with "org" mode and ignored in "cn_only" mode).
81+
# These are the default values for fields which will be placed in the
82+
# certificate. Do not leave any of these fields blank, although interactively
83+
# you may omit any specific field by typing the "." symbol (not valid for
84+
# email).
85+
#
86+
# NOTE: The following characters are not supported
87+
# in these "Organizational fields" by Easy-RSA:
88+
# back-tick (`)
89+
#
90+
<% if $country { -%>
91+
set_var EASYRSA_REQ_COUNTRY "<%= $country %>"
92+
<% } -%>
93+
<% if $province { -%>
94+
set_var EASYRSA_REQ_PROVINCE "<%= $province %>"
95+
<% } -%>
96+
<% if $city { -%>
97+
set_var EASYRSA_REQ_CITY "<%= $city %>"
98+
<% } -%>
99+
<% if $organization { -%>
100+
set_var EASYRSA_REQ_ORG "<%= $organization %>"
101+
<% } -%>
102+
<% if $email { -%>
103+
set_var EASYRSA_REQ_EMAIL "<%= $email %>"
104+
<% } -%>
105+
<% if $key_cn { -%>
106+
set_var EASYRSA_REQ_CN "<%= $key_cn %>"
107+
<% } -%>
108+
<% if $key_ou { -%>
109+
set_var EASYRSA_REQ_OU "<%= $key_ou %>"
110+
<% } -%>
111+
112+
# Preserve the Distinguished Name field order
113+
# of the certificate signing request
114+
# *Only* effective in --dn-mode=org
115+
#
116+
#set_var EASYRSA_PRESERVE_DN 1
117+
118+
# Set no password mode - This will create the entire PKI without passwords.
119+
# This can be better managed by choosing which entity private keys should be
120+
# encrypted with the following command line options:
121+
# Global option '--no-pass' or command option 'nopass'.
122+
#
123+
#set_var EASYRSA_NO_PASS 1
47124

48-
# Increase this to 2048 if you
49-
# are paranoid. This will slow
50-
# down TLS negotiation performance
51-
# as well as the one-time DH parms
52-
# generation process.
53-
export EASYRSA_KEY_SIZE=<%= $ssl_key_size %>
125+
# Choose a size in bits for your keypairs. The recommended value is 2048.
126+
# Using 2048-bit keys is considered more than sufficient for many years into
127+
# the future. Larger keysizes will slow down TLS negotiation and make key/DH
128+
# param generation take much longer. Values up to 4096 should be accepted by
129+
# most software. Only used when the crypto alg is rsa, see below.
130+
#
131+
set_var EASYRSA_KEY_SIZE <%= $ssl_key_size %>
54132

55133
# The default crypto mode is rsa; ec can enable elliptic curve support.
56134
# Note that not all software supports ECC, so use care when enabling it.
57135
# Choices for crypto alg are: (each in lower-case)
58136
# * rsa
59137
# * ec
60-
138+
# * ed
139+
#
61140
<% if $ssl_key_algo { -%>
62-
export EASYRSA_ALGO=<%= $ssl_key_algo %>
141+
set_var EASYRSA_ALGO <%= $ssl_key_algo %>
63142
<% } -%>
64-
# Define the named curve, used in ec mode only:
65143

144+
# Define the named curve, used in ec & ed modes:
145+
#
66146
<% if $ssl_key_curve { -%>
67-
export EASYRSA_CURVE=<%= $ssl_key_curve %>
147+
set_var EASYRSA_CURVE <%= $ssl_key_curve %>
68148
<% } -%>
69149

70150
# In how many days should the root CA key expire?
71-
export EASYRSA_CA_EXPIRE=<%= $ca_expire %>
151+
#
152+
set_var EASYRSA_CA_EXPIRE <%= $ca_expire %>
72153

73154
# In how many days should certificates expire?
74-
export EASYRSA_CERT_EXPIRE=<%= $key_expire %>
155+
#
156+
set_var EASYRSA_CERT_EXPIRE <%= $key_expire %>
75157

76-
export EASYRSA_CRL_DAYS=<%= $crl_days %>
158+
# How many days until the Certificate Revokation List will expire.
159+
#
160+
# IMPORTANT: When the CRL expires, an OpenVPN Server which uses a
161+
# CRL will reject ALL new connections, until the CRL is replaced.
162+
#
163+
set_var EASYRSA_CRL_DAYS <%= $crl_days %>
164+
165+
# Random serial numbers by default.
166+
# Set to 'no' for the old incremental serial numbers.
167+
#
168+
#set_var EASYRSA_RAND_SN "yes"
169+
170+
# Cut-off window for checking expiring certificates.
171+
#
172+
#set_var EASYRSA_PRE_EXPIRY_WINDOW 90
173+
174+
# Generate automatic subjectAltName for certificates
175+
#
176+
#set_var EASYRSA_AUTO_SAN 1
177+
178+
# Add critical attribute to X509 fields: basicConstraints (BC),
179+
# keyUsage (KU), extendedKeyUsage (EKU) or SAN
180+
#
181+
#set_var EASYRSA_BC_CRIT 1
182+
#set_var EASYRSA_KU_CRIT 1
183+
#set_var EASYRSA_EKU_CRIT 1
184+
#set_var EASYRSA_SAN_CRIT 1
185+
186+
# Disable automatic inline files
187+
#
188+
#set_var EASYRSA_DISABLE_INLINE 1
189+
190+
# Support deprecated "Netscape" extensions? (choices "yes" or "no").
191+
# The default is "no", to discourage use of deprecated extensions.
192+
# If you require this feature to use with --ns-cert-type, set this to "yes".
193+
# This support should be replaced with the more modern --remote-cert-tls
194+
# feature. If you do not use --ns-cert-type in your configs, it is safe,
195+
# and recommended, to leave this defined to "no".
196+
# When set to "yes", server-signed certs get the nsCertType=server attribute
197+
# and also get any NS_COMMENT defined below in the nsComment field.
198+
#
199+
#set_var EASYRSA_NS_SUPPORT "no"
200+
201+
# When NS_SUPPORT is set to "yes", this field is added as the nsComment field.
202+
# Set this blank to omit it. With NS_SUPPORT set to "no" this field is ignored.
203+
#
204+
#set_var EASYRSA_NS_COMMENT "Easy-RSA Generated Certificate"
205+
206+
# !!
207+
# NOTE: ADVANCED OPTIONS BELOW THIS POINT
208+
# PLAY WITH THEM AT YOUR OWN RISK
209+
# !!
210+
211+
# Broken shell command aliases: If you have a largely broken shell that is
212+
# missing any of these POSIX-required commands used by Easy-RSA, you will need
213+
# to define an alias to the proper path for the command. The symptom will be
214+
# some form of a "command not found" error from your shell. This means your
215+
# shell is BROKEN, but you can hack around it here if you really need. These
216+
# shown values are not defaults: it is up to you to know what you are doing if
217+
# you touch these.
218+
#
219+
#alias awk="/alt/bin/awk"
220+
#alias cat="/alt/bin/cat"
221+
222+
# X509 extensions directory:
223+
# If you want to customize the X509 extensions used, set the directory to look
224+
# for extensions here. Each cert type you sign must have a matching filename,
225+
# and an optional file named "COMMON" is included first when present. Note that
226+
# when undefined here, default behaviour is to look in $EASYRSA_PKI first, then
227+
# fallback to $EASYRSA for the "x509-types" dir. You may override this
228+
# detection with an explicit dir here.
229+
#
230+
#set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types"
231+
232+
# Non-functional
233+
# If you want to generate KDC certificates, you need to set the realm here.
234+
#
235+
#set_var EASYRSA_KDC_REALM "CHANGEME.EXAMPLE.COM"
236+
237+
# OpenSSL config file:
238+
# If you need to use a specific openssl config file, you can reference it here.
239+
# Normally this file is auto-detected from a file named openssl-easyrsa.cnf
240+
# from the EASYRSA_PKI or EASYRSA dir, in that order. NOTE that this file is
241+
# Easy-RSA specific and you cannot just use a standard config file, so this is
242+
# an advanced feature.
243+
#
244+
#set_var EASYRSA_SSL_CONF "$EASYRSA_PKI/openssl-easyrsa.cnf"
77245

78246
# Cryptographic digest to use.
79247
# Do not change this default unless you understand the security implications.
80248
# Valid choices include: md5, sha1, sha256, sha224, sha384, sha512
249+
#
250+
set_var EASYRSA_DIGEST <%= $digest %>
81251

82-
export EASYRSA_DIGEST=<%= $digest %>
83-
84-
export EASYRSA_DN="<%= $dn_mode %>"
85-
86-
# These are the default values for fields
87-
# which will be placed in the certificate.
88-
# Don't leave any of these fields blank.
89-
<% if $country { -%>
90-
export EASYRSA_REQ_COUNTRY="<%= $country %>"
91-
<% } -%>
92-
<% if $province { -%>
93-
export EASYRSA_REQ_PROVINCE="<%= $province %>"
94-
<% } -%>
95-
<% if $city { -%>
96-
export EASYRSA_REQ_CITY="<%= $city %>"
97-
<% } -%>
98-
<% if $organization { -%>
99-
export EASYRSA_REQ_ORG="<%= $organization %>"
100-
<% } -%>
101-
<% if $email { -%>
102-
export EASYRSA_REQ_EMAIL="<%= $email %>"
103-
<% } -%>
104-
<% if $key_cn { -%>
105-
export EASYRSA_REQ_CN="<%= $key_cn %>"
106-
<% } -%>
107-
<% if $key_ou { -%>
108-
export EASYRSA_REQ_OU="<%= $key_ou %>"
109-
<% } -%>
252+
# Batch mode. Leave this disabled unless you intend to call Easy-RSA explicitly
253+
# in batch mode without any user input, confirmation on dangerous operations,
254+
# or most output. Setting this to any non-blank string enables batch mode.
255+
#
256+
set_var EASYRSA_BATCH "1"

0 commit comments

Comments
 (0)