Merge branch 'peer-fp-mode-pki' of ssh://github.com/TinCanTech/easy-rsa into TinCanTech-peer-fp-mode-pki

Signed-off-by: Richard T Bonhomme <[email protected]>

Author: TinCanTech

ChangeLog

@@ -2,6 +2,7 @@ Easy-RSA 3 ChangeLog
 
 3.2.3 (TBD)
 
+   * peer-fingerprint mode: Make CA mode mutually exclusive to PFP mode (8c1c435) (#1347)
    * TLS key generation: Allow 'gen-tls-auth/crypt-key' without a CA Cert (2580dc2) (#1345)
    * Inline_file(): Improvements self-signed integration (bc72a21) (#1345)
    * verify_pki_init(): Always create 'issued' dir (f7e1b79) (#1343)
@@ -10,7 +11,7 @@ Easy-RSA 3 ChangeLog
    * Unit-test: Minimize Windows test (dc60c8b) (#1339)
    * ssl_cert_x509v3_eku(): Localize variables and minor improvements (8c19a95) (#1337)
    * inline_file(): Always use ssl_cert_x509v3_eku() to set $inline_crt_type (e1a2880) (#1337)
-   * sig-req: Disable inline for certificate type 'ca' (sub-ca) (f1252a3) (#1337)
+   * sign-req: Disable inline for certificate type 'ca' (sub-ca) (f1252a3) (#1337)
    * inline_file(): Localize variables $inline_crt_type & $inline_crt_CN (692e20a) (#1337)
    * add_critical_attrib(): export temp-file name as input file (e5b8d97) (#1333)
    * Unit-test: Drop old *nix test (63f3869) (#1335)

easyrsa3/easyrsa

@@ -1644,6 +1644,11 @@ get_passphrase() {
 
 # build-ca backend:
 build_ca() {
+	# Only allow if peer-fingerprint mode file does not exist
+	if [ -f "$EASYRSA_PKI"/peer-fp.mode ]; then
+		user_error "Cannot create CA in a peer-fingerprint PKI"
+	fi
+
 	cipher="-aes256"
 	unset -v sub_ca date_stamp x509 error_info \
 		ca_password_via_cmdline
@@ -2005,6 +2010,13 @@ Build-ca completed successfully."
 
 # Build self signed key pair
 self_sign() {
+	# Only allow if CA does not exist
+	if [ -f "$EASYRSA_PKI"/ca.crt ] || \
+		[ -f "$EASYRSA_PKI"/private/ca.key ]
+	then
+		user_error "Cannot create self-signed certificate in a CA."
+	fi
+
 	# Define x509 type
 	case "$1" in
 		server)
@@ -2187,6 +2199,11 @@ self-sign: Use ALGO:'$EASYRSA_ALGO' / CURVE:'$EASYRSA_CURVE'"
 	# inline key/cert/fingerprint
 	inline_file "$file_name_base"
 
+	# Mark PKI as self-signed only
+	pfp_data='peer-fp-mode - Please DO NOT DELETE this file'
+	print "$pfp_data" > "$EASYRSA_PKI"/peer-fp.mode || \
+		die "Failed to setup peer-fingerprint mode."
+
 	# User info
 	notice "\
 Self-signed '$EASYRSA_ALGO/$EASYRSA_CURVE' \