Skip to content

Remove init pki soft #1351

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 10, 2025
Merged

Remove init pki soft #1351

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
976f864
init-pki: Remove option 'soft' and TLS Key processing
TinCanTech Jun 9, 2025
c1c2a06
build-ca: Remove TLS Key processing
TinCanTech Jun 9, 2025
236fc9c
help: Remove init-pki command options 'hard/soft'
TinCanTech Jun 10, 2025
a26310a
ChangeLog: init-pki/build-ca: Remove option 'soft' and TLS Key proces…
TinCanTech Jun 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ChangeLog
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ Easy-RSA 3 ChangeLog

3.2.3 (TBD)

* build-ca: Remove TLS Key processing (c1c2a06) (#1351)
* init-pki: Remove option 'soft' and TLS Key processing (976f864) (#1351)
* peer-fingerprint mode: Make CA mode mutually exclusive to PFP mode (8c1c435) (#1347)
* TLS key generation: Allow 'gen-tls-auth/crypt-key' without a CA Cert (2580dc2) (#1345)
* Inline_file(): Improvements self-signed integration (bc72a21) (#1345)
Expand Down
167 changes: 8 additions & 159 deletions easyrsa3/easyrsa
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ For a list of utility commands, use:
./easyrsa help util

A list of commands is shown below:
init-pki [ cmd-opts ]
init-pki
self-sign-server <file_name_base> [ cmd-opts ]
self-sign-client <file_name_base> [ cmd-opts ]
build-ca [ cmd-opts ]
Expand Down Expand Up @@ -123,12 +123,6 @@ Usage: easyrsa [ OPTIONS.. ] <COMMAND> <TARGET> [ cmd-opts.. ]"
* init-pki [ cmd-opts ]

Removes & re-initializes the PKI directory for a new PKI"

opts="
* hard - Recursively delete the ENTIRE PKI directory (default).
* soft - Keep the named PKI directory and PKI 'vars' file intact.
Also keep the current Request files,
to be signed by a new CA (Partial CA renewal)."
;;
self-sign*)
text="
Expand Down Expand Up @@ -1398,23 +1392,6 @@ $verify_ca_help_note"

# init-pki backend:
init_pki() {
# Process command options
reset="hard"
while [ "$1" ]; do
case "$1" in
hard-reset|hard)
reset="hard"
confirm_msg=
;;
soft-reset|soft)
reset="soft"
confirm_msg='PARTIALLY '
;;
*) warn "Ignoring unknown command option: '$1'"
esac
shift
done

# EasyRSA will NOT do 'rm -rf /'
case "$EASYRSA_PKI" in
.|..|./|../|.//*|..//*|/|//*|\\|?:|'')
Expand All @@ -1426,116 +1403,22 @@ init_pki() {
confirm "Confirm removal: " "yes" "
WARNING!!!

You are about to ${confirm_msg}remove the EASYRSA_PKI at:
You are about to remove the EASYRSA_PKI at:
* $EASYRSA_PKI

and initialize a fresh PKI here."

# now remove it:
case "$reset" in
hard)
# Promote use of 'init-pki soft':
confirm "
WARNING: COMPLETELY DESTROY current PKI (NOT recommended) ?

[yes/NO]: " yes "\
******************************************
* SECOND WARNING - STOP - SECOND WARNING *
******************************************

To keep your current 'pki/vars' settings use 'init-pki soft'.
To keep your current Request files use 'init-pki soft'
The Requests can then be signed by a new CA (Partial CA renewal)
To keep your current Easy-RSA TLS Key use 'init-pki soft'
This private key file is in use by your current VPN.

** USE OF 'init-pki soft' IS RECOMMENDED **${NL}"

# # # shellcheck disable=SC2115 # Use "${var:?}"
rm -rf "$EASYRSA_PKI" || \
die "init-pki hard reset failed."
;;
soft)
# There is no unit test for a soft reset
# Save existing TLS key
tls_key_file="$EASYRSA_PKI"/private/easyrsa-tls.key
old_tls_key_file="$EASYRSA_PKI"/easyrsa-keepsafe-tls.key

# If both keys exist then they must be the same
if [ -f "$old_tls_key_file" ]; then
if [ -f "$tls_key_file" ]; then
# Match by hash
tls_key_hash="$(
"$EASYRSA_OPENSSL" dgst -sha256 \
"$tls_key_file")"
tls_key_hash="${tls_key_hash##* }"
old_tls_key_hash="$(
"$EASYRSA_OPENSSL" dgst -sha256 \
"$old_tls_key_file")"
old_tls_key_hash="${old_tls_key_hash##* }"
[ "$tls_key_hash" = "$old_tls_key_hash" ] || \
user_error "\
Easy-RSA TLS Keys do not match, only ONE of these files is valid:
* $tls_key_file
* $old_tls_key_file

Please delete the key above that is no longer in use."
fi
fi

# Save existing TLS key
if [ -f "$tls_key_file" ]; then
tls_key_data="$(cat "$tls_key_file")"
else
tls_key_data=
fi

# Do NOT remove pki/reqs sub-dir, for "renew ca"
for i in ca.crt crl.pem \
issued private inline revoked renewed expired \
serial serial.old index.txt index.txt.old \
index.txt.attr index.txt.attr.old certs_by_serial
do
# # # shellcheck disable=SC2115 # Use "${var:?}"
target="$EASYRSA_PKI/$i"
if [ "${target%/*}" ]; then
rm -rf "$target" || \
die "init-pki soft reset(1) failed!"
else
die "init-pki soft reset(2) failed!"
fi
done
;;
*)
user_error "Unknown reset type: $reset"
esac
fi

# # # shellcheck disable=SC2115 # Use "${var:?}"
rm -rf "$EASYRSA_PKI" || \
die "init-pki hard reset failed."

# new dirs:
easyrsa_mkdir "$EASYRSA_PKI"
for i in issued private reqs; do
easyrsa_mkdir "${EASYRSA_PKI}/$i"
done

# If one existed then recreate old TLS key backup file
if [ "$tls_key_data" ]; then
header="# Easy-RSA TLS Key: $(date)${NL}# DO NOT DELETE"
printf '%s\n\n%s\n' "$header" "$tls_key_data" \
> "$old_tls_key_file"
tls_msg="${NL}
Previous Easy-RSA TLS key saved to:
* $old_tls_key_file${NL}"
else
# if an OLD TLS key still exists then notify user
if [ -f "$old_tls_key_file" ]; then
tls_msg="${NL}
Existing Easy-RSA TLS key preserved:
* $old_tls_key_file${NL}"
else
tls_msg=
fi
fi

# write pki/vars.example - no temp-file because no session
write_legacy_file_v2 \
vars "$EASYRSA_PKI"/vars.example overwrite || \
Expand All @@ -1553,7 +1436,7 @@ Your newly created PKI dir is:
select_vars
information "\
Using Easy-RSA configuration:
* ${EASYRSA_VARS_FILE:-undefined}${tls_msg}"
* ${EASYRSA_VARS_FILE:-undefined}"
} # => init_pki()

# Find support files from various sources
Expand Down Expand Up @@ -1733,40 +1616,6 @@ Unable to create necessary PKI files (permissions?)"
> "$EASYRSA_PKI/serial" || die "$err_msg"
unset -v err_msg

# If one exists then recreate TLS Key
tls_key_file="$EASYRSA_PKI"/private/easyrsa-tls.key
old_tls_key_file="$EASYRSA_PKI"/easyrsa-keepsafe-tls.key
if [ -f "$old_tls_key_file" ]; then
confirm "Re-install existing Easy-RSA TLS Key ? " yes "
An Easy-RSA TLS Key, saved by 'init-pki soft', has been found.
This TLS Key is in use by your VPN, it is recommended that you
re-install this TLS Key.

Note:
This is a private key and will NOT be added to new inline files.

To create a new Easy-RSA TLS Key, delete this old TLS Key above."
cp "$old_tls_key_file" "$tls_key_file" || \
warn "Failed to install TLS Key!"
tls_key_msg="${NL}
NOTICE: The previous Easy-RSA TLS Key has been installed:
* $tls_key_file

This TLS Key will NOT be added to new inline files. These new
inline files can then be easily distributed to your servers and
clients. The TLS Key that your servers and clients have previously
received, can be added to the inline file manually.

To re-enable automatically adding this TLS Key to inline files,
simply delete the backup TLS Key at:
* $old_tls_key_file

To create a new Easy-RSA TLS Key, delete both TLS Keys above."
else
tls_key_msg="${NL}
Create an OpenVPN TLS-AUTH|TLS-CRYPT-V1 key now: See 'help gen-tls'"
fi

# Set ssl batch mode, as required
[ "$EASYRSA_BATCH" ] && ssl_batch=1

Expand Down Expand Up @@ -2002,7 +1851,7 @@ Prior to signing operations, place your resulting Sub-CA cert at:
else
notice "\
CA creation complete. Your new CA certificate is at:
* $out_file${tls_key_msg}
* $out_file

Build-ca completed successfully."
fi
Expand Down