From 3f6d6bbb84eeed3df019036e1bc0c668c00f73e5 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 2 Jan 2024 23:02:15 +0000
Subject: [PATCH 01/31] README.md: Update branch structure - V2

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 README.md | 34 +++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index d6c3981c8..dca664f20 100644
--- a/README.md
+++ b/README.md
@@ -37,22 +37,30 @@ is recommended to use a release, and priority will be given to bugs identified i
 the most recent release.
 
 The prior 2.x and 1.x versions are available as release branches for
-tracking and possible back-porting of relevant fixes. Branch layout is:
-
-    master         <- v3.2.x - Rolling
-    v3.n.n-<NAME>     Pre-release branches, used for staging.
-    3.1.8             Present: bugfix/security/openssl updates for v3.1.7
-    3.0.10            Absent: bugfix/security/openssl updates for v3.0.9
-    v3.0.6            Archived: Has known bugs, OpenSSL v3 incompatible.
-    v3.0.5            Archived: Has known bugs, OpenSSL v3 incompatible.
-    v3.0.4            Archived: Has known bugs, OpenSSL v3 incompatible.
-    release/3.0       Archived: Pending deprecation to unmaintained.
-    release/2.x       Archived: Unmaintained.
-    release/1.x       Archived: Unmaintained.
-    testing           Sandbox only; Subject to change, without warning.
+tracking and possible back-porting of relevant fixes.
+
+Branch layout is:
+
+    master             <- Active: v3.2.x - Rolling.
+    v3.<N>.<N>-<LABEL>    Active: Development branches.
+    testing               Sandbox: Subject to change without notice.
+    v3.1.8                Sunset: Bugfix only for v3.1.7
+
+    The following are NOT compatible with OpenSSL version 3:
+
+    v3.0.6                Inactive: Archived.
+    v3.0.5                Inactive: Archived.
+    v3.0.4                Inactive: Archived.
+    release/3.0           Inactive: Archived.
+    release/2.x           Inactive: Archived.
+    release/1.x           Inactive: Unmaintained.
 
 LICENSING info for 3.x is in the [COPYING.md](COPYING.md) file
 
+## Contributing
+
+Please refer to: [doc/EasyRSA-Contributing.md](doc/EasyRSA-Contributing.md)
+
 # Code style, standards
 
 We are attempting to adhere to the POSIX standard, which can be found here:

From da9e59477f8c580143db1657ff5bea98c6ff4531 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 2 Jan 2024 23:46:00 +0000
Subject: [PATCH 02/31] export-p12: Always set 'friendlyName' to file-name-base

This changes default behavior from NEVER setting a friendlyName
to ALWAYS setting friendlyName to the file-name-base.

The friendlyName is "typically displayed in list boxes by software
importing the file".

Having Easy-RSA populate this field with known values, which do not
leak excess information, is considered to be appropriate.

An alternate friendlyName can be configured by using:
* Global option '--usefn=<friendlyName>'

Fallback to previous behavior can be configured by using:
* Command option 'nofn' ('friendlyname' will not be set)

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index b6aa434dd..775a128f8 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -3238,11 +3238,15 @@ Run easyrsa without commands for usage and command help."
 	key_in="$EASYRSA_PKI/private/$file_name_base.key"
 	crt_ca="$EASYRSA_PKI/ca.crt"
 
+	# Always set a friendly_name
+	set_var EASYRSA_P12_FR_NAME "$file_name_base"
+	friendly_name="$EASYRSA_P12_FR_NAME"
+
 	# opts support
 	cipher=-aes256
 	want_ca=1
 	want_key=1
-	unset -v nokeys friendly_name
+	unset -v nokeys
 	while [ "$1" ]; do
 		case "$1" in
 			noca)
@@ -3258,10 +3262,11 @@ Run easyrsa without commands for usage and command help."
 			nopass)
 				[ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1
 			;;
-			usefn)
-				friendly_name="$file_name_base"
+			nofn)
+				unset friendly_name
 			;;
-			*) warn "Ignoring unknown command option: '$1'"
+			*)
+				warn "Ignoring unknown option: '$1'"
 		esac
 		shift
 	done
@@ -3378,10 +3383,10 @@ Missing User Certificate, expected at:
 		easyrsa_openssl pkcs12 -export \
 			-in "$crt_in" \
 			-out "$pkcs_out" \
-			${nokeys} \
 			-inkey "$key_in" \
-			${want_ca:+ -certfile "$crt_ca"} \
+			${nokeys} \
 			${friendly_name:+ -name "$friendly_name"} \
+			${want_ca:+ -certfile "$crt_ca"} \
 			${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
 			${EASYRSA_PASSOUT:+ -passout "$EASYRSA_PASSOUT"} \
 				|| die "Failed to export PKCS#12"
@@ -6112,6 +6117,9 @@ while :; do
 $EASYRSA_EXTRA_EXTS
 subjectAltName = $val"
 		;;
+	--usefn)
+		export EASYRSA_P12_FR_NAME="$val"
+		;;
 	--version)
 		shift "$#"
 		set -- "$@" "version"

From b08024613bcce3bdf3bedab9d960ccee8e84b37d Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Wed, 3 Jan 2024 00:31:01 +0000
Subject: [PATCH 03/31] export-p12: Add 'help' for 'friendlyName' - Usage:
 'help friendly'

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 775a128f8..19ec4e71b 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -335,7 +335,21 @@ cmd_help() {
                   (Equivalent to global option '--nopass|--no-pass')
       * noca    - Do not include the ca.crt file in the PKCS12 output
       * nokey   - Do not include the private key in the PKCS12 output
-      * usefn   - Use <file_name_base> as friendly name"
+      * nofn    - Do not set 'freindlyName'
+                  For more, see: 'easyrsa help friendly'"
+	;;
+	friendly)
+		text_only=1
+		text="
+* export-p12: Internal file label 'friendlyName'
+
+      The 'friendlyname' is always set to the file-name-base.
+
+      An alternate friendlyName can be configured by using:
+      * Global option '--usefn=<friendlyName>'
+
+      Fallback to previous behavior can be configured by using:
+      * Command option 'nofn' ('friendlyname' will not be set)"
 	;;
 	export-p7)
 		text="
@@ -566,10 +580,14 @@ Certificate & Request options: (these impact cert/req field values)
 
 --subca-len=#   : Path length of signed intermediate CA certificates
 --copy-ext      : Copy included request X509 extensions (namely subjAltName)
+
 --san|--subject-alt-name=<subjectAltName>
                 : Add a subjectAltName.
                   For more info and syntax, see: 'easyrsa help altname'
 
+--usefn=NAME    : export-p12, set 'friendlyName' to NAME
+                  For more, see: 'easyrsa help friendly'
+
 Distinguished Name mode:
 
 --dn-mode=MODE  : Distinguished Name mode to use 'cn_only' (Default) or 'org'

From d7712ed0a0970036ca4c3764020e4607495c34ba Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Wed, 3 Jan 2024 18:19:03 +0000
Subject: [PATCH 04/31] ChangeLog: export-p12: Always set 'friendlyName' to
 file-name-base

Also, improve current v3.2.0 details by replacing single pull-request
ID with shortened commit hash for each ChangeLog item.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 ChangeLog | 38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 0db95db99..411b3a54e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,26 +1,38 @@
 Easy-RSA 3 ChangeLog
 
 3.2.0 (TBD)
-   * Rename X509-type file `code-signing` to `codeSigning` (Part of #1046)
-     The original file will be retained as `code-signing`, however, the automatic
-     X509-types creation will name the file `codeSigning`. This effectively means
-     that both are valid X509-types, until `code-signing` is dropped.
+
+   PENDING: Branch-merge: v3.2.0-beta2 (#1055)
+   * export-p12: Always set 'friendlyName' to file-name-base (da9e594)
+   * Update OpenSSL to 3.2.0
+
+   Branch-merge: v3.2.0-beta1 (#1046) 2023/12/15 Commit: 7120876
+
    * Important note: As of Easy-RSA version 3.2.0-beta1, the configuration files
      `vars.example`, `openssl-eayrsa.cnf` and all files in `x509-types` directory
      are no longer required. Package maintainers can omit these files in the future.
      All files are created as required and deleted upon command completion.
-     `vars.example` is created during `init-pki` and placed in the fresh PKI. 66a8f3e
+     `vars.example` is created during `init-pki` and placed in the fresh PKI.
      These files will be retained for downstream packaging compatibility.
-   * New command 'write': Write 'legacy' files to stdout or files (#1046) c814e0a
-   * New Command 'rand': Expose easyrsa_random() to the command line (#1046) 6131cbf
-   * Remove function 'set_pass_legacy()' (#1045)
-   * Remove command 'rewind-renew' (#1045)
-   * Remove command 'rebuild' (#1045)
-   * Remove command 'upgrade' (#1045)
-   * Remove EASYRSA_NO_VARS; Allow graceful use without a vars file (#1043)
+
+   * Rename X509-type file `code-signing` to `codeSigning` (1c6b31a)
+     The original file will be retained as `code-signing`, however, the automatic
+     X509-types creation will name the file `codeSigning`. This effectively means
+     that both are valid X509-types, until `code-signing` is dropped.
+   * init-pki: Always write vars.example file to fresh PKI (66a8f3e)
+   * New command 'write': Write 'legacy' files to stdout or files (c814e0a)
+   * New Command 'rand': Expose easyrsa_random() to the command line (6131cbf)
+   * Remove function 'set_pass_legacy()' (7470c2a)
+   * Remove command 'rewind-renew' (72b4079)
+   * Remove command 'rebuild' (d6953cc)
+   * Remove command 'upgrade' (6a88edd)
+
+   Branch-merge: v3.2.0-alpha2 (#1043) 2023/12/7 Commit: ed0dc46
+   * Remove EASYRSA_NO_VARS; Allow graceful use without a vars file (3c0ca17)
+
+   Branch-merge: v3.2.0-alpha1 (#1041) 2023/12/2 Commit: 42c2e95
    * New diagnostic command 'display-cn' (#1040)
    * Expand renewable certificate types to include code-signing (#1039)
-   * Update OpenSSL to 3.2.0
 
 3.1.7 (2023-10-13)
    * Rewrite vars-auto-detect, adhere to EasyRSA-Advanced.md (#1029)

From f8514de515b33359f244102ed3647e8a9f67e3b5 Mon Sep 17 00:00:00 2001
From: Thomas Oettli <spacefreak@noop.ch>
Date: Thu, 4 Jan 2024 08:49:43 +0100
Subject: [PATCH 05/31] export-p12: New command option 'legacy'

---
 ChangeLog        | 1 +
 easyrsa3/easyrsa | 9 +++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 411b3a54e..56d5c81f3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,7 @@ Easy-RSA 3 ChangeLog
 3.2.0 (TBD)
 
    PENDING: Branch-merge: v3.2.0-beta2 (#1055)
+   * export-p12: New command option 'legacy'
    * export-p12: Always set 'friendlyName' to file-name-base (da9e594)
    * Update OpenSSL to 3.2.0
 
diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 19ec4e71b..917cfca67 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -336,7 +336,8 @@ cmd_help() {
       * noca    - Do not include the ca.crt file in the PKCS12 output
       * nokey   - Do not include the private key in the PKCS12 output
       * nofn    - Do not set 'freindlyName'
-                  For more, see: 'easyrsa help friendly'"
+                  For more, see: 'easyrsa help friendly'
+      * legacy  - Use legacy mode of operation"
 	;;
 	friendly)
 		text_only=1
@@ -3264,7 +3265,7 @@ Run easyrsa without commands for usage and command help."
 	cipher=-aes256
 	want_ca=1
 	want_key=1
-	unset -v nokeys
+	unset -v nokeys legacy
 	while [ "$1" ]; do
 		case "$1" in
 			noca)
@@ -3283,6 +3284,9 @@ Run easyrsa without commands for usage and command help."
 			nofn)
 				unset friendly_name
 			;;
+			legacy)
+				legacy=-legacy
+			;;
 			*)
 				warn "Ignoring unknown option: '$1'"
 		esac
@@ -3403,6 +3407,7 @@ Missing User Certificate, expected at:
 			-out "$pkcs_out" \
 			-inkey "$key_in" \
 			${nokeys} \
+			${legacy} \
 			${friendly_name:+ -name "$friendly_name"} \
 			${want_ca:+ -certfile "$crt_ca"} \
 			${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \

From 1f6c8512b43b63152df28f7ccdf383c95bed4c17 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Thu, 4 Jan 2024 16:33:19 +0000
Subject: [PATCH 06/31] export-p12 Legacy mode: Minor imrovements

Require OpenSSL v3 for use.

If used then add an extra error message, to clarify that SSL option
'-legacy' may not be supported by the SSL library in use.

Improve 'help' and Changelog details.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 ChangeLog        | 5 +++--
 easyrsa3/easyrsa | 8 +++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 56d5c81f3..9584e9868 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,9 +3,10 @@ Easy-RSA 3 ChangeLog
 3.2.0 (TBD)
 
    PENDING: Branch-merge: v3.2.0-beta2 (#1055)
-   * export-p12: New command option 'legacy'
+   * export-p12: New command option 'legacy'. OpenSSL V3 Only (f8514de)
+     Fallback to encryption algorithm RC2_CBC or 3DES_CBC
    * export-p12: Always set 'friendlyName' to file-name-base (da9e594)
-   * Update OpenSSL to 3.2.0
+   * Update OpenSSL to 3.2.0 (03e4829)
 
    Branch-merge: v3.2.0-beta1 (#1046) 2023/12/15 Commit: 7120876
 
diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 917cfca67..7b548a7f2 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -337,7 +337,8 @@ cmd_help() {
       * nokey   - Do not include the private key in the PKCS12 output
       * nofn    - Do not set 'freindlyName'
                   For more, see: 'easyrsa help friendly'
-      * legacy  - Use legacy mode of operation"
+      * legacy  - Use legacy encryption algorithm RC2_CBC or 3DES_CBC
+                  OpenSSL V3 ONLY: Default algorithm is AES-256-CBC"
 	;;
 	friendly)
 		text_only=1
@@ -3285,6 +3286,8 @@ Run easyrsa without commands for usage and command help."
 				unset friendly_name
 			;;
 			legacy)
+				[ "$openssl_v3" ] || \
+					user_error "Option 'legacy' requires SSL version 3"
 				legacy=-legacy
 			;;
 			*)
@@ -3401,6 +3404,9 @@ Missing User Certificate, expected at:
 	p12)
 		pkcs_out="$EASYRSA_PKI/private/$file_name_base.p12"
 
+		[ "$legacy" ] && \
+			error_info="SSL library may not support -legacy mode"
+
 		# export the p12:
 		easyrsa_openssl pkcs12 -export \
 			-in "$crt_in" \

From 7313fb0a8e883f251d333b069ade14f3f7271b18 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Fri, 5 Jan 2024 14:39:37 +0000
Subject: [PATCH 07/31] gen-crl: Use SSL option '-crldays' not '-days'

SSL option -days only configures certificate lifetime, it does not
apply to the life-time of a CRL. For a CRL SSL option -crldays is
required.

The script only succeeded before because openssl-easyrsa.cnf file
always configured "default_crl_days = $EASYRSA_CRL_DAYS".

Changing the function to use -crldays means that 'default_crl_days'
field can be removed from openssl-easyrsa.cnf file.

However, this change only removes 'default_crl_days' from the auto-
generated version of openssl-easyrsa.cnf - This means no changes
are required for packaging the SSL config file.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 7b548a7f2..773e2e9a0 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -3187,7 +3187,7 @@ gen_crl() {
 	fi
 
 	easyrsa_openssl ca -utf8 -gencrl -out "$out_file_tmp" \
-		${EASYRSA_CRL_DAYS:+ -days "$EASYRSA_CRL_DAYS"} \
+		${EASYRSA_CRL_DAYS:+ -crldays "$EASYRSA_CRL_DAYS"} \
 		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} || \
 			die "CRL Generation failed."
 
@@ -5801,8 +5801,14 @@ x509_extensions	= basic_exts		# The extensions to add to the cert
 # is designed for will. In return, we get the Issuer attached to CRLs.
 crl_extensions	= crl_ext
 
+# These fields are always configured via the command line.
+# These fields are removed from this here-doc but retained
+# in 'openssl-easyrsa.cnf' file, in case something breaks.
+# default_days is no longer required by Easy-RSA
 default_days	= $ENV::EASYRSA_CERT_EXPIRE	# how long to certify for
-default_crl_days	= $ENV::EASYRSA_CRL_DAYS	# how long before next CRL
+# default_crl_days is no longer required by Easy-RSA
+#default_crl_days	= $ENV::EASYRSA_CRL_DAYS	# how long before next CRL
+
 default_md	= $ENV::EASYRSA_DIGEST		# use public key default MD
 preserve	= no			# keep passed DN ordering
 

From 2a8c0dec12ef884771b6ed1c0bb08f62a8917657 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Fri, 5 Jan 2024 23:45:40 +0000
Subject: [PATCH 08/31] Always try to use built-in openssl-easysa.cnf here-doc

The SSL config file is always verified as present when
secure_session() is called, at the beginning of execution.

This change forces the use of a temp-file, containing the
current here-doc version of the SSL config file.

If the current, existing file is NOT recognised as a hash
identical file to either the release version or the here-doc
version, which can include new version hashes, then the file
is left in place and used.

Otherwise, if the current file is recognised then it will be
deleted and, from then on, a temp-file based on the here-doc
will always be used in future.

This approach also solves the problem of the unpopulated SSL
config file field 'default_days = $ENV::EASYRSA_CERT_EXPIRE'.

The solution here is to remove the unnecessary 'default_days'
definition. The 'default_days' field is always configured via
the command line.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 43 ++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 38 insertions(+), 5 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 773e2e9a0..611eb3315 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -5397,13 +5397,46 @@ force_set_var() {
 	die "force_set_var - set_var '$*'"
 } # => force_set_var()
 
-
-
 # Verify: $EASYRSA_SSL_CONF pki/openssl-easyrsa.cnf
 # or create temp-file
 write_easyrsa_ssl_cnf_tmp() {
-	[ -f "$EASYRSA_SSL_CONF" ] && return
+	if [ -f "$EASYRSA_SSL_CONF" ]; then
+		# Set known hashes
+		# openssl-easyrsa.cnf sha256 hash - v3.2.x
+		known_hash_file="\
+13ca05f031d58c5e2912652b33099ce9\
+ac05f49595e5d5fe96367229e3ce070c"
+
+		# Built-in here-doc v3.2.0-1
+		known_hash_heredoc_1="\
+82439f1860838e28f6270d5d06b17717\
+56db777861e19bf9edc21222f86a310d"
+
+		# Get file hash
+		file_hash="$(
+			"$EASYRSA_OPENSSL" dgst -sha256 -r "$EASYRSA_SSL_CONF"
+		)"
+
+		# Strip excess SSL info
+		file_hash="${file_hash%% *}"
+
+		# Check file hash against known hash
+		if [ "$file_hash" = "$known_hash_file" ] || \
+			[ "$file_hash" = "$known_hash_heredoc_1" ]
+		then
+			# Permanently remove file and use temp-files
+			unset -v file_hash known_hash_file known_hash_heredoc_1
+			rm "$EASYRSA_SSL_CONF" || : # Ignore failure
+			verbose "write_easyrsa_ssl_cnf_tmp: Removed SSL Conf!"
+		else
+			# File has been changed, leave in place
+			unset -v file_hash known_hash_file known_hash_heredoc_1
+			verbose "write_easyrsa_ssl_cnf_tmp: NO CHANGE!"
+			return 0
+		fi
+	fi
 
+	# SET and USE temp-file from here-doc Now
 	# Create temp-file
 	ssl_cnf_tmp=
 	easyrsa_mktemp ssl_cnf_tmp || die "\
@@ -5769,7 +5802,7 @@ fi
 CREATE_VARS_EXAMPLE
 	;;
 	ssl-cnf)
-	# SSL config
+	# SSL config v3.2.0-1
 	cat << "CREATE_SSL_CONFIG"
 # For use with Easy-RSA 3.0+ and OpenSSL or LibreSSL
 
@@ -5805,7 +5838,7 @@ crl_extensions	= crl_ext
 # These fields are removed from this here-doc but retained
 # in 'openssl-easyrsa.cnf' file, in case something breaks.
 # default_days is no longer required by Easy-RSA
-default_days	= $ENV::EASYRSA_CERT_EXPIRE	# how long to certify for
+#default_days	= $ENV::EASYRSA_CERT_EXPIRE	# how long to certify for
 # default_crl_days is no longer required by Easy-RSA
 #default_crl_days	= $ENV::EASYRSA_CRL_DAYS	# how long before next CRL
 

From 75dcfe66feeaecb5771111c2be9ee167ef529c81 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat, 6 Jan 2024 00:26:25 +0000
Subject: [PATCH 09/31] ChangeLog: Always try to use built-in
 openssl-easysa.cnf here-doc

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 9584e9868..feb13fce6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,8 @@ Easy-RSA 3 ChangeLog
 3.2.0 (TBD)
 
    PENDING: Branch-merge: v3.2.0-beta2 (#1055)
+   * Always use here-doc version of openssl-easyrsa.cnf (2a8c0de)
+     Only use here-doc if the current version is recognised by sha256 hash.
    * export-p12: New command option 'legacy'. OpenSSL V3 Only (f8514de)
      Fallback to encryption algorithm RC2_CBC or 3DES_CBC
    * export-p12: Always set 'friendlyName' to file-name-base (da9e594)

From 2e9b869cf3e33b3a062a54e048aa23557a8aaba2 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat, 6 Jan 2024 00:27:13 +0000
Subject: [PATCH 10/31] cleanup(): For option --keep-tmp, do not try to remove
 temp-session

The temp-session has been moved to temp-storage, so cannot be removed.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 611eb3315..4b9fe9a93 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -902,12 +902,15 @@ Temporary session not preserved."
 				rm -rf "$keep_tmp"
 				mv -f "$secured_session" "$keep_tmp"
 				print "Temp session preserved: $keep_tmp"
+				unset -v secured_session
 			fi
 		fi
 
 		# remove temp-session
-		remove_secure_session || \
-			warn "cleanup - remove_secure_session failed"
+		if [ "$secured_session" ]; then
+			remove_secure_session || \
+				warn "cleanup - remove_secure_session failed"
+		fi
 	fi
 
 	# shellcheck disable=SC3040 # POSIX set - cleanup()

From 39e49056f3984a4a790f081a01a782461defe102 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat, 6 Jan 2024 01:28:22 +0000
Subject: [PATCH 11/31] Ignore minor (well understood) shellcheck warning

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 1 +
 1 file changed, 1 insertion(+)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 4b9fe9a93..8fd86a9fd 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1476,6 +1476,7 @@ get_passphrase() {
 			printf '\n%s\n' \
 				"Passphrase must be at least 4 characters!"
 		else
+			# shellcheck disable=SC2229 # does not read 't'
 			read -r "$t" <<- SECRET
 				$r
 				SECRET

From 6837a1ac13f155bbb4d4b1957e7d57c033063853 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat, 6 Jan 2024 02:25:35 +0000
Subject: [PATCH 12/31] Create /issued during init-pki instead of build-ca

The reason for this is to allow signed certificates to be imported,
in order to create inline files for remote clients, who have sent
a CSR to the CA and received a signed certificate from the CA.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 8fd86a9fd..8f0e76a25 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1374,7 +1374,7 @@ and initialize a fresh PKI here."
 	fi
 
 	# new dirs:
-	for i in private reqs inline; do
+	for i in issued private reqs inline; do
 		mkdir -p "$EASYRSA_PKI/$i" || \
 			die "\
 Failed to create PKI file structure (permissions?)"
@@ -1557,7 +1557,7 @@ current CA. To start a new CA, run init-pki first."
 	# create necessary dirs:
 	err_msg="\
 Unable to create necessary PKI files (permissions?)"
-	for i in issued certs_by_serial \
+	for i in certs_by_serial \
 		revoked/certs_by_serial revoked/private_by_serial \
 		revoked/reqs_by_serial
 	do

From 6c47f7a9f1793a38a59fd2388511534229268668 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat, 6 Jan 2024 19:13:56 +0000
Subject: [PATCH 13/31] Add newline separators to standard output

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 8f0e76a25..ae34a5453 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -521,6 +521,7 @@ ${opts:-
       * No supported command options}"
 		fi
 	fi
+	print
 } # => cmd_help()
 
 # Options usage
@@ -624,8 +625,8 @@ die() {
 	print "
 Easy-RSA error:
 
-$1
-"
+$1${NL}"
+
 	# error_info is for hard-to-spot errors!
 	if [ "$error_info" ]; then
 		print "  * $cmd: ${error_info}${NL}"
@@ -645,7 +646,8 @@ EasyRSA version $EASYRSA_version
 
 Error
 -----
-$1"
+$1${NL}"
+
 	easyrsa_exit_with_error=1
 	cleanup
 } # => user_error()
@@ -662,7 +664,7 @@ warn() {
 	print "
 WARNING
 =======
-$1"
+$1${NL}"
 } # => warn()
 
 # informational notices to stdout
@@ -671,7 +673,7 @@ notice() {
 	print "
 Notice
 ------
-$1"
+$1${NL}"
 } # => notice()
 
 # Helpful information

From 6e1ac1f30718f3ed8f1a092e632a3bf1e5f7454b Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sun, 7 Jan 2024 01:57:14 +0000
Subject: [PATCH 14/31] renew: Simplify CA index.txt.attr file check

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 34 +++++++++-------------------------
 1 file changed, 9 insertions(+), 25 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index ae34a5453..8444517bd 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -2766,8 +2766,15 @@ Run easyrsa without commands for usage and command help."
 	inline_in="$in_dir/inline/${file_name_base}.inline"
 
 	# Upgrade CA index.txt.attr - unique_subject = no
-	ca_unique_subject_no || \
-		die "Failed to upgrade CA to support renewal."
+	if grep -q 'unique_subject = no' \
+		"$EASYRSA_PKI/index.txt.attr"
+	then
+		: # ok
+	else
+		printf '%s\n' 'unique_subject = no' \
+			> "$EASYRSA_PKI/index.txt.attr" || \
+				die "Incompatible CA configuration"
+	fi
 
 	# deprecate ALL options
 	while [ "$1" ]; do
@@ -2997,29 +3004,6 @@ Failed to remove inline file:
 	return 0
 } # => renew_move()
 
-# Set unique_subject = no in index.txt.attr
-ca_unique_subject_no() {
-	[ -d "$EASYRSA_PKI" ] || return 0
-	attr_file="$EASYRSA_PKI/index.txt.attr"
-	verbose "\
-Confirm: index.txt.attr exists and 'unique_subject = no'"
-
-	if [ -f "$attr_file" ]; then
-		if grep -q '^[[:blank:]]*unique_subject = no' \
-			"$attr_file"
-		then
-			return 0
-		fi
-	else
-		return 0
-	fi
-
-	# Otherwise this is required for all easyrsa v3
-	printf '%s\n' 'unique_subject = no' > "$attr_file" || \
-		die "ca_unique_subject_no - Failed write"
-	verbose "Set unique_subject = no in index.txt.attr"
-} #=> ca_unique_subject_no()
-
 # revoke-renewed backend
 revoke_renewed() {
 	# pull filename base:

From 084e8a3fdbb1519033b5a666699d71e674099bfc Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sun, 7 Jan 2024 17:37:19 +0000
Subject: [PATCH 15/31] Move "PKI and CA init flags" before select_vars()

These flags should be set before selecting a vars file.

Set information about "no vars file selected" to verbose level.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 66 +++++++++++++++++++++++-------------------------
 1 file changed, 32 insertions(+), 34 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 8444517bd..d67beac55 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -5117,11 +5117,8 @@ select_vars() {
 		fi
 	fi
 
-	# User info
+	# if select_vars failed to find a vars file
 	if [ -z "$EASYRSA_VARS_FILE" ]; then
-		[ "$require_pki" ] && information "\
-No Easy-RSA 'vars' configuration file exists!"
-		# select_vars failed to find a vars file
 		verbose "select_vars: No vars"
 		return 1
 	fi
@@ -5140,11 +5137,6 @@ Missing vars file:
 	# 'vars' now MUST exist
 	[ -e "$target_file" ] || user_error "\
 Missing vars file:
-* $target_file"
-
-	# Installation information
-	[ "$require_pki" ] && information "\
-Using Easy-RSA 'vars' configuration:
 * $target_file"
 
 	# Sanitize vars
@@ -6219,11 +6211,41 @@ done
 cmd="$1"
 [ "$1" ] && shift # scrape off command
 
+# Establish PKI and CA initialisation requirements
+unset -v require_pki require_ca ignore_vars
+case "$cmd" in
+	''|help|-h|--help|--usage| \
+	version|show-host|rand|random)
+		ignore_vars=1
+	;;
+	init-pki|clean-all)
+		: # No change
+	;;
+	*)
+		require_pki=1
+		case "$cmd" in
+			gen-req|gen-dh|build-ca|show-req| \
+			make-safe-ssl|export-p*|inline|write)
+				: # No change
+			;;
+			*)
+				require_ca=1
+		esac
+esac
+
 # Intelligent env-var detection and auto-loading:
 # Select vars file as EASYRSA_VARS_FILE
 # then source the vars file, if found
 # otherwise, ignore no vars file
-select_vars && source_vars "$EASYRSA_VARS_FILE"
+if select_vars; then
+	information "\
+Using Easy-RSA 'vars' configuration:
+* $target_file"
+	source_vars "$EASYRSA_VARS_FILE"
+else
+	verbose "\
+No Easy-RSA 'vars' configuration file exists!"
+fi
 
 # then set defaults
 default_vars
@@ -6250,30 +6272,6 @@ if [ "$working_safe_ssl_conf" ]; then
 	die "working_safe_ssl_conf must not be set!"
 fi
 
-# Establish PKI and CA initialisation requirements
-# This avoids unnecessary warnings and notices
-# Used by verify_working_env()
-unset -v require_pki require_ca ignore_vars
-case "$cmd" in
-	''|help|-h|--help|--usage| \
-	version|show-host|rand|random)
-		ignore_vars=1
-	;;
-	init-pki|clean-all)
-		: # No change
-	;;
-	*)
-		require_pki=1
-		case "$cmd" in
-			gen-req|gen-dh|build-ca|show-req| \
-			make-safe-ssl|export-p*|inline|write)
-				: # No change
-			;;
-			*)
-				require_ca=1
-		esac
-esac
-
 # Hand off to the function responsible
 # ONLY verify_working_env() for valid commands
 case "$cmd" in

From 7290835b93557fa876a0039ee8415ad415327d4a Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sun, 7 Jan 2024 20:05:44 +0000
Subject: [PATCH 16/31] write: Forcibly silence execution

This ensures command 'write' output will remain unpolluted by user
and diagnostic messages; Which allows for the raw command output to
be extenally redirected to a file.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index d67beac55..84db253e9 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -5145,6 +5145,7 @@ Missing vars file:
 		-e '[^(]`[^)]' \
 		-e '[[:blank:]]export[[:blank:]]*' \
 		-e '[[:blank:]]unset[[:blank:]]*' \
+		-e '^  > ' \
 		"$target_file"
 	then
 		# here we go ..
@@ -5191,6 +5192,16 @@ These problems have been found in your 'vars' settings:${NL}"
   Remove 'unset' ('force_set_var' may also work)."
 		fi
 
+		# No redirection - caused by --verbose output
+		if grep -q \
+			-e '^  > ' \
+			"$target_file"
+		then
+			err_msg="${err_msg}
+  Use of unsupported characters:
+  These characters are not supported: '>' redirection"
+		fi
+
 		# Fatal error
 		user_error "${err_msg}${NL}
 Please, correct these errors and try again."
@@ -6226,7 +6237,11 @@ case "$cmd" in
 		case "$cmd" in
 			gen-req|gen-dh|build-ca|show-req| \
 			make-safe-ssl|export-p*|inline|write)
-				: # No change
+				# write is not compatible with diagnostics
+				if [ "$cmd" = write ]; then
+					unset -v EASYRSA_VERBOSE
+					EASYRSA_SILENT=1
+				fi
 			;;
 			*)
 				require_ca=1

From c0d12ca14d23e8ef370b05de1e5c3936d42a7c2e Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sun, 7 Jan 2024 23:44:03 +0000
Subject: [PATCH 17/31] Minor improvements to help and information

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 84db253e9..44eda63bc 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -16,7 +16,7 @@ usage() {
 	print "
 Easy-RSA 3 usage and overview
 
-USAGE: easyrsa [global-options] COMMAND [command-options]
+$easyrsa_help_title
 
 To get detailed usage and help for a command, use:
   ./easyrsa help COMMAND
@@ -93,7 +93,7 @@ DIRECTORY STATUS (commands would take effect on these locations)
          PKI: $pki_dir
    vars-file: ${EASYRSA_VARS_FILE:-Missing or undefined}${ivmsg}
   x509-types: ${EASYRSA_EXT_DIR:-Missing or undefined}
-$CA_status"
+$CA_status${NL}"
 } # => usage()
 
 # Detailed command help
@@ -103,7 +103,10 @@ $CA_status"
 # Commands are TAB indented, while text is SPACE indented.
 # 'case' indentation is minimalistic.
 cmd_help() {
+	easyrsa_help_title="\
+Usage: easyrsa [ OPTIONS.. ] <COMMAND> <TARGET> [ cmd-opts.. ]"
 	unset -v text err_text opts text_only
+
 	case "$1" in
 	init-pki|clean-all)
 		text="
@@ -407,12 +410,12 @@ cmd_help() {
       Types:
       * ssl-cnf  - Write openssl-easyrsa.cnf file.
       * COMMON|ca|server|serverClient|client|codeSigning|email|kdc
-                   Write x509-type <type> file.
+                 - Write x509-type <type> file.
       * legacy   - Write ALL support files (above) to <DIR>.
                    Will create <DIR>/x509-types directory.
                    Default <DIR> is EASYRSA_PKI or EASYRSA.
       * legacy-hard
-                   Same as 'legacy' plus OVER-WRITE files.
+                 - Same as 'legacy' plus OVER-WRITE files.
       * safe-ssl - Expand EasyRSA SSL config file for LibreSSL.
       * vars     - Write vars.example file."
 		opts="
@@ -496,9 +499,12 @@ These commands are safe to test and will NOT effect your PKI.
 	;;
 	opts|options)
 		opt_usage
+		cleanup ok
 	;;
 	"")
-		usage ;;
+		usage
+		cleanup ok
+	;;
 	*)
 		err_text="
   Unknown command: '$1' \
@@ -508,8 +514,10 @@ These commands are safe to test and will NOT effect your PKI.
 
 	if [ "$err_text" ]; then
 		print "${err_text}"
+		print "$easyrsa_help_title"
 	else
 		# display the help text
+		print "$easyrsa_help_title"
 		[ "$text" ] && print "$text"
 
 		if [ "$text_only" ]; then
@@ -6238,10 +6246,14 @@ case "$cmd" in
 			gen-req|gen-dh|build-ca|show-req| \
 			make-safe-ssl|export-p*|inline|write)
 				# write is not compatible with diagnostics
-				if [ "$cmd" = write ]; then
-					unset -v EASYRSA_VERBOSE
-					EASYRSA_SILENT=1
-				fi
+				case "$cmd" in
+					write)
+						unset -v EASYRSA_VERBOSE
+						EASYRSA_SILENT=1
+					;;
+					*)
+						: # ok
+				esac
 			;;
 			*)
 				require_ca=1
@@ -6253,9 +6265,9 @@ esac
 # then source the vars file, if found
 # otherwise, ignore no vars file
 if select_vars; then
-	information "\
+	[ "$ignore_vars" ] || information "\
 Using Easy-RSA 'vars' configuration:
-* $target_file"
+* $EASYRSA_VARS_FILE"
 	source_vars "$EASYRSA_VARS_FILE"
 else
 	verbose "\

From 9be2cac32b3c348a314a97394539b9ef326fa308 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Mon, 8 Jan 2024 18:51:51 +0000
Subject: [PATCH 18/31] write: Silence 'vars' in use message; Rename
 ignore_vars -> quiet_vars

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 44eda63bc..bcf714b12 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -78,6 +78,7 @@ A list of commands is shown below:
 		CA_status="   CA status: CA has not been built"
 	fi
 
+	# check for vars changing PKI unexpectedly!
 	if [ "$invalid_vars" ]; then
 		ivmsg="
    *WARNING*: \
@@ -974,13 +975,13 @@ Temporary session not preserved."
 # Make a copy safe SSL config file
 make_safe_ssl() {
 	easyrsa_openssl makesafeconf
-
 	notice "\
 Safe SSL config file created at:
 * $EASYRSA_SAFE_CONF"
+
 	verbose "\
 make_safe_ssl: NEW SSL cnf file: $safe_ssl_cnf_tmp"
-} # => make_safe_ssl_copy()
+} # => make_safe_ssl()
 
 # Escape hazardous characters
 # Auto-escape hazardous characters:
@@ -5334,7 +5335,7 @@ validate_default_vars() {
 
 	# This is an almost unacceptable error
 	invalid_vars=1
-	[ "$ignore_vars" ] || user_error "\
+	[ "$quiet_vars" ] || user_error "\
 The values in the vars file have unexpectedly changed the values for
 EASYRSA and/or EASYRSA_PKI. The default pki/vars file is forbidden to
 change these values.
@@ -6231,11 +6232,11 @@ cmd="$1"
 [ "$1" ] && shift # scrape off command
 
 # Establish PKI and CA initialisation requirements
-unset -v require_pki require_ca ignore_vars
+unset -v require_pki require_ca quiet_vars
 case "$cmd" in
 	''|help|-h|--help|--usage| \
 	version|show-host|rand|random)
-		ignore_vars=1
+		quiet_vars=1
 	;;
 	init-pki|clean-all)
 		: # No change
@@ -6250,6 +6251,7 @@ case "$cmd" in
 					write)
 						unset -v EASYRSA_VERBOSE
 						EASYRSA_SILENT=1
+						quiet_vars=1
 					;;
 					*)
 						: # ok
@@ -6265,7 +6267,7 @@ esac
 # then source the vars file, if found
 # otherwise, ignore no vars file
 if select_vars; then
-	[ "$ignore_vars" ] || information "\
+	[ "$quiet_vars" ] || information "\
 Using Easy-RSA 'vars' configuration:
 * $EASYRSA_VARS_FILE"
 	source_vars "$EASYRSA_VARS_FILE"

From 1260519b12057344827d439a38a9a4ff3774a3c5 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 9 Jan 2024 00:48:33 +0000
Subject: [PATCH 19/31] write: Allow 'stdout' as a target for 'safe-ssl'

This looks more intrusive than it really is.

The problem to solve is creating a openssl-easyrsa.cnf file
in the EASYRSA_TEMP_DIR, as a temp-file.

1.
Remove write_easyrsa_ssl_cnf_tmp() from secure_session():
This was not the correct place to create the SSL cnf file.

2.
make_safe_ssl(): pass parameters to 'easyrsa_openssl makesafeconf'

3.
Specify a new variable for the 'safe-ssl' file: $safe_target_file

3.a
If $safe_target_file is specified then send output to it.
Otherwise, send output to 'stdout' (As all other 'write' commands).

4.
Secure a temp-session, only if it has not been done before.

4.a
Create openssl-easyrsa.cnf (Temp), only if a secure session was
created above. Otherwise, this file has already been created.

5.
write_easyrsa_ssl_cnf_tmp:
Set OPENSSL_CONF=/dev/null for subshell use of raw SSL execution.

6.
Have legacy_files() require_pki=1 and verify_working_env().
Move '$legacy_file_over_write' confirmation to legacy_files()

7.
Change 'write safe-ssl' from fixed output to the same as all
other 'write' commands: output to 'stdout' or a predetermined
file-name in a user specified directory, eg:
- 'easyrsa write safe-ssl' or 'easyrsa write safe-ssl pki'

8.
Recatagorise 'write' as not requiring a PKI, because we may want
to output to 'stdout' without a working PKI.

9.
IMPORTANT: This is new for Easy-RSA, correct use of a temp-dir.

If a working temp-dir exists then create a temp-session
and openssl-easyrsa.cnf (Temp) file.

This decouples the default temp-dir from a default PKI.

Unrelated change:
- Change a 'print' to 'information' in --keep-tmp code.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 96 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 63 insertions(+), 33 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index bcf714b12..dc0559949 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -769,9 +769,6 @@ secure_session() {
 				working_safe_ssl_conf
 			easyrsa_err_log="$secured_session/error.log"
 
-			# Verify or create: EASYRSA_SSL_CONF
-			write_easyrsa_ssl_cnf_tmp
-
 			verbose "\
 secure_session: CREATED: $secured_session"
 			return
@@ -912,7 +909,7 @@ Temporary session not preserved."
 				mkdir -p "$keep_tmp"
 				rm -rf "$keep_tmp"
 				mv -f "$secured_session" "$keep_tmp"
-				print "Temp session preserved: $keep_tmp"
+				information "Temp session preserved: $keep_tmp"
 				unset -v secured_session
 			fi
 		fi
@@ -974,7 +971,7 @@ Temporary session not preserved."
 
 # Make a copy safe SSL config file
 make_safe_ssl() {
-	easyrsa_openssl makesafeconf
+	easyrsa_openssl makesafeconf "$@"
 	notice "\
 Safe SSL config file created at:
 * $EASYRSA_SAFE_CONF"
@@ -1139,7 +1136,10 @@ easyrsa_openssl() {
 		rand)
 			die "easyrsa_openssl: Illegal SSL command: rand"
 		;;
-		makesafeconf) makesafeconf=1 ;;
+		makesafeconf)
+			safe_target_file="$1"
+			makesafeconf=1
+		;;
 		*) :
 	esac
 
@@ -1170,8 +1170,11 @@ easyrsa_openssl() {
 	makesafeconf)
 		# COPY temp-file to safessl-easyrsa.cnf
 		unset -v makesafeconf
-		cp -f "$safe_ssl_cnf_tmp" "$EASYRSA_SAFE_CONF" && \
-			return
+		if [ "$safe_target_file" ]; then
+			cp -f "$safe_ssl_cnf_tmp" "$safe_target_file" && return
+		else
+			cat "$safe_ssl_cnf_tmp" && return
+		fi
 	;;
 	*)
 		# Exec SSL
@@ -5353,7 +5356,11 @@ verify_working_env() {
 		verify_pki_init
 
 		# Temp dir session and default SSL conf file
-		secure_session
+		if [ -z "$secured_session" ]; then
+			secure_session
+			# Verify or create temp EASYRSA_SSL_CONF
+			write_easyrsa_ssl_cnf_tmp
+		fi
 
 		# Verify selected algorithm and parameters
 		verify_algo_params
@@ -5416,6 +5423,7 @@ ac05f49595e5d5fe96367229e3ce070c"
 
 		# Get file hash
 		file_hash="$(
+			OPENSSL_CONF=/dev/null
 			"$EASYRSA_OPENSSL" dgst -sha256 -r "$EASYRSA_SSL_CONF"
 		)"
 
@@ -5478,6 +5486,15 @@ write_x509_type_tmp() {
 
 # Write ALL legacy files to $1 or default
 legacy_files() {
+	require_pki=1
+	verify_working_env
+
+	if [ "$legacy_file_over_write" ]; then
+		confirm "${NL}  Confirm OVER-WRITE files ? " yes "
+'legacy-hard' will OVER-WRITE all legacy files to default settings.
+Legacy files: openssl-easyrsa.cnf and x509-types/ directory."
+	fi
+
 	legacy_out_d="${1:-$EASYRSA_PKI}"
 	legacy_out_d="${legacy_out_d:-$EASYRSA}"
 	[ -d "$legacy_out_d" ] || \
@@ -5512,11 +5529,15 @@ write() {
 
 	case "$write_type" in
 	safe-ssl)
-		# Only write to EASYRSA_PKI
-		[ -z "$write_dir" ] || \
-			user_error "Unsupported option: '$write_dir'"
-		verify_working_env
-		make_safe_ssl || die "write failed"
+		# write to stdout or $write_dir/safessl-easyrsa.cnf
+		if [ "$write_dir" ]; then
+			[ -d "$write_dir" ] || \
+				user_error "Missing directory '$write_dir'"
+			write_file="$write_dir"/safessl-easyrsa.cnf
+			make_safe_ssl "$write_file" || die "write failed"
+		else
+			make_safe_ssl || die "write failed"
+		fi
 		return
 	;;
 	ssl-cnf)
@@ -6235,27 +6256,26 @@ cmd="$1"
 unset -v require_pki require_ca quiet_vars
 case "$cmd" in
 	''|help|-h|--help|--usage| \
-	version|show-host|rand|random)
+	version|show-host|rand|random|write)
 		quiet_vars=1
+		# write is not compatible with diagnostics
+		case "$cmd" in
+			write)
+				unset -v EASYRSA_VERBOSE
+				EASYRSA_SILENT=1
+			;;
+			*)
+				: # ok
+		esac
 	;;
 	init-pki|clean-all)
-		: # No change
+		: # ok
 	;;
 	*)
 		require_pki=1
 		case "$cmd" in
-			gen-req|gen-dh|build-ca|show-req| \
-			make-safe-ssl|export-p*|inline|write)
-				# write is not compatible with diagnostics
-				case "$cmd" in
-					write)
-						unset -v EASYRSA_VERBOSE
-						EASYRSA_SILENT=1
-						quiet_vars=1
-					;;
-					*)
-						: # ok
-				esac
+			gen-req|gen-dh|build-ca|show-req|export-p*|inline)
+				: # ok
 			;;
 			*)
 				require_ca=1
@@ -6294,6 +6314,21 @@ locate_support_files
 # Verify SSL Lib - One time ONLY
 verify_ssl_lib
 
+# If there is a valid temp-dir:
+if [ "$require_pki" ]; then
+	# taken care of later by verify_working_env()
+	:
+else
+	# Create temp-session and openssl-easyrsa.cnf (Temp) now
+	if [ -d "$EASYRSA_TEMP_DIR" ]; then
+		# Temp dir session and default SSL conf file
+		secure_session
+
+		# Verify or create: EASYRSA_SSL_CONF
+		write_easyrsa_ssl_cnf_tmp
+	fi
+fi
+
 # Check $working_safe_ssl_conf, to build
 # a fully configured safe ssl conf, on the
 # next invocation of easyrsa_openssl()
@@ -6449,16 +6484,11 @@ case "$cmd" in
 		legacy)
 			# over-write NO
 			shift
-			verify_working_env
 			legacy_files "$@"
 			;;
 		legacy-hard)
 			# over-write YES
-			confirm "${NL}  Confirm OVER-WRITE files ? " yes "
-'legacy-hard' will OVER-WRITE all legacy files to default settings.
-Legacy files: openssl-easyrsa.cnf and x509-types/ directory."
 			shift
-			verify_working_env
 			legacy_file_over_write=1
 			legacy_files "$@"
 			;;

From e8b762a2471ef76496519543d6671f2c3c73ae20 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 9 Jan 2024 00:59:25 +0000
Subject: [PATCH 20/31] write: rename command option 'safe-ssl' to 'safe-cnf'

There is now 'ssl-cnf' or 'safe-cnf'.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index dc0559949..7dc1b9f6f 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -417,7 +417,7 @@ Usage: easyrsa [ OPTIONS.. ] <COMMAND> <TARGET> [ cmd-opts.. ]"
                    Default <DIR> is EASYRSA_PKI or EASYRSA.
       * legacy-hard
                  - Same as 'legacy' plus OVER-WRITE files.
-      * safe-ssl - Expand EasyRSA SSL config file for LibreSSL.
+      * safe-cnf - Expand EasyRSA SSL config file for LibreSSL.
       * vars     - Write vars.example file."
 		opts="
       * <DIR>    - If <DIR> is specified then files are created.
@@ -5528,7 +5528,7 @@ write() {
 	write_file=
 
 	case "$write_type" in
-	safe-ssl)
+	safe-cnf)
 		# write to stdout or $write_dir/safessl-easyrsa.cnf
 		if [ "$write_dir" ]; then
 			[ -d "$write_dir" ] || \

From 616367807d921aaffcfe69cf146c786246398124 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 9 Jan 2024 01:01:06 +0000
Subject: [PATCH 21/31] help: Remove 'make-safe-ssl' (Obsolete)

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 7dc1b9f6f..9a68cefc7 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -241,12 +241,6 @@ Usage: easyrsa [ OPTIONS.. ] <COMMAND> <TARGET> [ cmd-opts.. ]"
 
       This command will use the system time to update the status of
       issued certificates."
-	;;
-	make-safe-ssl)
-		text="
-* make-safe-ssl
-
-      Generate a safe SSL config file"
 	;;
 	show-req|show-cert)
 		text="

From 906b737f1b47858f88365c9da4750b544edb36d7 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 9 Jan 2024 02:03:30 +0000
Subject: [PATCH 22/31] easyrsa_mktemp(): Additional help on error and a
 helpful comments

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 9a68cefc7..f67295350 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -799,7 +799,7 @@ easyrsa_mktemp - input error"
 
 	# session directory must exist
 	[ "$secured_session" ] || die "\
-easyrsa_mktemp - Temporary session undefined"
+easyrsa_mktemp - Temporary session undefined (--tmp-dir)"
 
 	# Update counter
 	mktemp_counter="$(( mktemp_counter + 1 ))"
@@ -5401,7 +5401,8 @@ force_set_var() {
 } # => force_set_var()
 
 # Verify: $EASYRSA_SSL_CONF pki/openssl-easyrsa.cnf
-# or create temp-file
+# If the existing file is default then delete it
+# and create temp-file. Otherwise, leave in place.
 write_easyrsa_ssl_cnf_tmp() {
 	if [ -f "$EASYRSA_SSL_CONF" ]; then
 		# Set known hashes
@@ -5436,6 +5437,8 @@ ac05f49595e5d5fe96367229e3ce070c"
 			# File has been changed, leave in place
 			unset -v file_hash known_hash_file known_hash_heredoc_1
 			verbose "write_easyrsa_ssl_cnf_tmp: NO CHANGE!"
+
+			# Do NOT replace the existing file
 			return 0
 		fi
 	fi

From c615f30ed06621857c936f7ee3bd2488398515f0 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 9 Jan 2024 14:20:10 +0000
Subject: [PATCH 23/31] show-expire: Recreate openssl-easyrsa.cnf (Temp) in
 read_db()

The temp-session is recreate for each record read, otherwise the
temp-file counter grows as the database grows.  This way, temp-files
are created as if each record is a separate instance of 'easyrsa'.

Recreate the openssl-easyrsa.cnf (Temp) when the temp-session
is recreated.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index f67295350..1f89d722b 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -4475,6 +4475,8 @@ read_db() {
 			die "read_db - remove_secure_session"
 		secure_session || \
 			die "read_db - secure_session"
+		# Recreate openssl-easyrsa.cnf (Temp)
+		write_easyrsa_ssl_cnf_tmp
 
 		# Interpret the db/certificate record
 		unset -v db_serial db_cn db_revoke_date db_reason

From edb1ffbbde49359763a2365fa6ff1419ddc83cfc Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 9 Jan 2024 19:29:39 +0000
Subject: [PATCH 24/31] write: Always use verify_working_env()

Move the creation of secure_session and openssl-easyrsa.cnf (Temp)
to verify_working_env(). Create a session and temp-file in the temp-dir
EASRSA_TEMP_DIR, provided that the directory exists.

By default, EASYRSA_TEMP_DIR is set to the current PKI but that can be
decoupled and command 'write' can be run without a PKI, so long as a
valid temp-dir exists.

Correction to error message about 'write <type>' being unknown.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 35 ++++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 1f89d722b..7a970d742 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -5346,6 +5346,7 @@ ${unexpected_error}"
 
 # Verify working environment
 verify_working_env() {
+	verbose "verify_working_env: BEGIN"
 	# For commands which 'require a PKI' and PKI exists
 	if  [ "$require_pki" ]; then
 		# Verify PKI is initialised
@@ -5354,6 +5355,7 @@ verify_working_env() {
 		# Temp dir session and default SSL conf file
 		if [ -z "$secured_session" ]; then
 			secure_session
+
 			# Verify or create temp EASYRSA_SSL_CONF
 			write_easyrsa_ssl_cnf_tmp
 		fi
@@ -5365,6 +5367,20 @@ verify_working_env() {
 		if [ "$require_ca" ]; then
 			verify_ca_init
 		fi
+	else
+		# For commands that do not require a PKI
+		# but do require a temp-dir, eg. 'write'
+		# If there is a valid temp-dir:
+		# Create temp-session and openssl-easyrsa.cnf (Temp) now
+		if [ -d "$EASYRSA_TEMP_DIR" ]; then
+			# Temp dir session and default SSL conf file
+			if [ -z "$secured_session" ]; then
+				secure_session
+
+				# Verify or create: EASYRSA_SSL_CONF
+				write_easyrsa_ssl_cnf_tmp
+			fi
+		fi
 	fi
 	verbose "verify_working_env: COMPLETED Handover-to: $cmd"
 } # => verify_working_env()
@@ -5559,7 +5575,7 @@ write() {
 		fi
 	;;
 	*)
-		user_error "write - unknown type '$type'"
+		user_error "write - unknown type '$write_type'"
 	esac
 
 	# Check for output directory and file-name
@@ -6313,21 +6329,6 @@ locate_support_files
 # Verify SSL Lib - One time ONLY
 verify_ssl_lib
 
-# If there is a valid temp-dir:
-if [ "$require_pki" ]; then
-	# taken care of later by verify_working_env()
-	:
-else
-	# Create temp-session and openssl-easyrsa.cnf (Temp) now
-	if [ -d "$EASYRSA_TEMP_DIR" ]; then
-		# Temp dir session and default SSL conf file
-		secure_session
-
-		# Verify or create: EASYRSA_SSL_CONF
-		write_easyrsa_ssl_cnf_tmp
-	fi
-fi
-
 # Check $working_safe_ssl_conf, to build
 # a fully configured safe ssl conf, on the
 # next invocation of easyrsa_openssl()
@@ -6476,7 +6477,7 @@ case "$cmd" in
 			easyrsa_exit_with_error=1
 		;;
 	write)
-		# verify_working_env - Not required
+		verify_working_env
 		# Write legacy files to write_dir
 		# or EASYRSA_PKI or EASYRSA
 		case "$1" in

From dc9db73d51672258540390a2a1d34e6b13441e3e Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Tue, 9 Jan 2024 19:32:27 +0000
Subject: [PATCH 25/31] ChangeLog: Add notice that default openssl-easyrsa.cnf
 is DELETED

Minor improvement to code: Expand short-circuit switch.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 ChangeLog        |  1 +
 easyrsa3/easyrsa | 11 +++++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index feb13fce6..6e47f26ca 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,7 @@ Easy-RSA 3 ChangeLog
    PENDING: Branch-merge: v3.2.0-beta2 (#1055)
    * Always use here-doc version of openssl-easyrsa.cnf (2a8c0de)
      Only use here-doc if the current version is recognised by sha256 hash.
+     This will DELETE any default version of openssl-easyrsa.cnf
    * export-p12: New command option 'legacy'. OpenSSL V3 Only (f8514de)
      Fallback to encryption algorithm RC2_CBC or 3DES_CBC
    * export-p12: Always set 'friendlyName' to file-name-base (da9e594)
diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 7a970d742..7048a9fb0 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -5449,8 +5449,15 @@ ac05f49595e5d5fe96367229e3ce070c"
 		then
 			# Permanently remove file and use temp-files
 			unset -v file_hash known_hash_file known_hash_heredoc_1
-			rm "$EASYRSA_SSL_CONF" || : # Ignore failure
-			verbose "write_easyrsa_ssl_cnf_tmp: Removed SSL Conf!"
+
+			if rm "$EASYRSA_SSL_CONF" 2>/dev/null; then
+				verbose "\
+write_easyrsa_ssl_cnf_tmp: Removed SSL Conf!"
+			else
+				# Ignore failure
+				verbose "\
+write_easyrsa_ssl_cnf_tmp: Removed SSL Conf failed!"
+			fi
 		else
 			# File has been changed, leave in place
 			unset -v file_hash known_hash_file known_hash_heredoc_1

From f67d0d308f884e8a0d0c6acc73df02a893892bff Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Wed, 10 Jan 2024 00:30:53 +0000
Subject: [PATCH 26/31] Simplify 'case' "initilisation flags" for command
 'write'

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 7048a9fb0..a160225d3 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -6278,17 +6278,13 @@ cmd="$1"
 unset -v require_pki require_ca quiet_vars
 case "$cmd" in
 	''|help|-h|--help|--usage| \
-	version|show-host|rand|random|write)
+	version|show-host|rand|random)
 		quiet_vars=1
+	;;
+	write)
 		# write is not compatible with diagnostics
-		case "$cmd" in
-			write)
-				unset -v EASYRSA_VERBOSE
-				EASYRSA_SILENT=1
-			;;
-			*)
-				: # ok
-		esac
+		unset -v EASYRSA_VERBOSE
+		EASYRSA_SILENT=1
 	;;
 	init-pki|clean-all)
 		: # ok

From 60216d5b16f635350ec734d0343072ab917fd072 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Wed, 10 Jan 2024 13:27:05 +0000
Subject: [PATCH 27/31] When using built-in heredoc for SSL conf do NOT delete
 existing file

Commit 2a8c0de introduced "Delete existing openssl-easyrsa.cnf".

This commit changes from deleting the file to ignoring the file
and creating a drop-in temp-file but ONLY if the file is unchanged.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 41 +++++++++++++++++++++--------------------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index a160225d3..abfd6b4d2 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -5423,6 +5423,8 @@ force_set_var() {
 # and create temp-file. Otherwise, leave in place.
 write_easyrsa_ssl_cnf_tmp() {
 	if [ -f "$EASYRSA_SSL_CONF" ]; then
+		verbose "write_easyrsa_ssl_cnf_tmp: SSL config EXISTS"
+
 		# Set known hashes
 		# openssl-easyrsa.cnf sha256 hash - v3.2.x
 		known_hash_file="\
@@ -5438,34 +5440,33 @@ ac05f49595e5d5fe96367229e3ce070c"
 		file_hash="$(
 			OPENSSL_CONF=/dev/null
 			"$EASYRSA_OPENSSL" dgst -sha256 -r "$EASYRSA_SSL_CONF"
-		)"
+		)" || die "hash malfunction!"
 
 		# Strip excess SSL info
 		file_hash="${file_hash%% *}"
 
-		# Check file hash against known hash
-		if [ "$file_hash" = "$known_hash_file" ] || \
-			[ "$file_hash" = "$known_hash_heredoc_1" ]
-		then
-			# Permanently remove file and use temp-files
-			unset -v file_hash known_hash_file known_hash_heredoc_1
+		# Compare SSL output
+		case "$file_hash" in
+		*[!1234567890abcdef]*)
+			die "hash failure: $file_hash"
+		esac
 
-			if rm "$EASYRSA_SSL_CONF" 2>/dev/null; then
-				verbose "\
-write_easyrsa_ssl_cnf_tmp: Removed SSL Conf!"
-			else
-				# Ignore failure
-				verbose "\
-write_easyrsa_ssl_cnf_tmp: Removed SSL Conf failed!"
-			fi
-		else
+		# Check file hash against known hash
+		case "$file_hash" in
+		"$known_hash_file") ;;
+		"$known_hash_heredoc_1") ;;
+		*)
 			# File has been changed, leave in place
 			unset -v file_hash known_hash_file known_hash_heredoc_1
-			verbose "write_easyrsa_ssl_cnf_tmp: NO CHANGE!"
+			verbose "write_easyrsa_ssl_cnf_tmp: SSL config NO CHANGE!"
 
-			# Do NOT replace the existing file
+			# Use the existing and changed file ONLY
 			return 0
-		fi
+		esac
+
+		# Ignore this file, prefer to use a temp-file
+		unset -v file_hash known_hash_file known_hash_heredoc_1
+		verbose "write_easyrsa_ssl_cnf_tmp: SSL config IGNORED"
 	fi
 
 	# SET and USE temp-file from here-doc Now
@@ -5481,7 +5482,7 @@ write_easyrsa_ssl_cnf_tmp - write ssl-cnf"
 	# export SSL cnf tmp
 	export EASYRSA_SSL_CONF="$ssl_cnf_tmp"
 	verbose "\
-write_easyrsa_ssl_cnf_tmp: create_openssl_easyrsa_cnf OK"
+write_easyrsa_ssl_cnf_tmp: SSL config using temp-file"
 } # => write_easyrsa_ssl_cnf_tmp()
 
 # Write x509 type file to a temp file

From f5f1fac6f7e08101f0279f45f7ebb9c84d890c2f Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Wed, 10 Jan 2024 13:36:27 +0000
Subject: [PATCH 28/31] ChangeLog: Never delete existing openssl-easyrsa.cnf

Commit 60216d5, partially revert 2a8c0de.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 ChangeLog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 6e47f26ca..e7d49c43b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,7 +5,7 @@ Easy-RSA 3 ChangeLog
    PENDING: Branch-merge: v3.2.0-beta2 (#1055)
    * Always use here-doc version of openssl-easyrsa.cnf (2a8c0de)
      Only use here-doc if the current version is recognised by sha256 hash.
-     This will DELETE any default version of openssl-easyrsa.cnf
+     The current file is NEVER deleted (60216d5). Partially revert: 2a8c0de
    * export-p12: New command option 'legacy'. OpenSSL V3 Only (f8514de)
      Fallback to encryption algorithm RC2_CBC or 3DES_CBC
    * export-p12: Always set 'friendlyName' to file-name-base (da9e594)

From 8608d5295e44134883743041bc1e1b5c6be20c9c Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Wed, 10 Jan 2024 16:26:53 +0000
Subject: [PATCH 29/31] Move default assignment of EASYRSA_SSL_CONF to
 locate_support_files()

Allow easyrsa to find openssl-easyrsa.cnf in multiple locations.

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 37 ++++++++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 9 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index abfd6b4d2..9e6aed76d 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1425,6 +1425,12 @@ locate_support_files() {
 	# Room for more..
 	# '/etc/easy-rsa' - Last resort
 
+	# Not currently used:
+	# Set EASYRSA_PKI only flag
+	#is_in_pki=1
+	#x509_dir_in_pki=""
+	#ssl_cnf_in_pki=""
+
 	# Find data-files
 	for area in \
 		"$EASYRSA_PKI" \
@@ -1436,14 +1442,26 @@ locate_support_files() {
 		'/etc/easy-rsa' \
 		# EOL
 	do
-			# Find x509-types
-			[ -e "${area}/${x509_types_dir}" ] && set_var \
-				EASYRSA_EXT_DIR "${area}/${x509_types_dir}"
+		# Find x509-types
+		if [ -e "${area}/${x509_types_dir}" ]; then
+			set_var EASYRSA_EXT_DIR "${area}/${x509_types_dir}"
+			#[ "$is_in_pki" ] && x509_dir_in_pki=1
+			verbose "> Found x509 dir: ${area}/${x509_types_dir}"
+		fi
+
+		# Find openssl-easyrsa.cnf
+		if [ -e "${area}/${ssl_cnf_file}" ]; then
+			set_var EASYRSA_SSL_CONF "${area}/${ssl_cnf_file}"
+			#[ "$is_in_pki" ] && ssl_cnf_in_pki=1
+			verbose "> Found SSL cnf: ${area}/${ssl_cnf_file}"
+		fi
 
-			# Find openssl-easyrsa.cnf
-			[ -e "${area}/${ssl_cnf_file}" ] && set_var \
-				EASYRSA_SSL_CONF "${area}/${ssl_cnf_file}"
+		# Clear EASYRSA_PKI only flag
+		#unset -v is_in_pki
 	done
+
+	verbose "> EASYRSA_EXT_DIR: $EASYRSA_EXT_DIR"
+	verbose "> EASYRSA_SSL_CONF: $EASYRSA_SSL_CONF"
 	verbose "locate_support_files: COMPLETED"
 } # => locate_support_files()
 
@@ -5289,9 +5307,10 @@ Algorithm '$EASYRSA_ALGO' is invalid: Must be 'rsa', 'ec' or 'ed'"
 	set_var EASYRSA_REQ_CN			ChangeMe
 	set_var EASYRSA_DIGEST			sha256
 
-	# verified or created by secure_session()
-	set_var EASYRSA_SSL_CONF		\
-		"$EASYRSA_PKI/openssl-easyrsa.cnf"
+	# Now set by locate_support_files()
+	#set_var EASYRSA_SSL_CONF		\
+	#	"$EASYRSA_PKI/openssl-easyrsa.cnf"
+
 	# created as required
 	set_var EASYRSA_SAFE_CONF		\
 		"$EASYRSA_PKI/safessl-easyrsa.cnf"

From 7f7a58d74ee4fc85dfbdd96100eed45da380ac04 Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Wed, 10 Jan 2024 20:31:25 +0000
Subject: [PATCH 30/31] write_easyrsa_ssl_cnf_tmp(): Refactor and add all known
 hashes

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 easyrsa3/easyrsa | 62 +++++++++++++++++++++++++++++++++++-------------
 1 file changed, 46 insertions(+), 16 deletions(-)

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 9e6aed76d..254233637 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -5445,13 +5445,28 @@ write_easyrsa_ssl_cnf_tmp() {
 		verbose "write_easyrsa_ssl_cnf_tmp: SSL config EXISTS"
 
 		# Set known hashes
-		# openssl-easyrsa.cnf sha256 hash - v3.2.x
-		known_hash_file="\
+		# 3.1.7 -> Current
+		known_file_317="\
 13ca05f031d58c5e2912652b33099ce9\
 ac05f49595e5d5fe96367229e3ce070c"
 
-		# Built-in here-doc v3.2.0-1
-		known_hash_heredoc_1="\
+		# 3.1.5 -> 3.1.6
+		known_file_315="\
+87d51ca0db1cc0ac3cc2634792fc5576\
+e0034ebf9d546de11674b897514f3afb"
+
+		# 3.1.0 -> 3.1.4
+		known_file_310="\
+5455947df40f01f845bf79c1e89f102c\
+628faaa65d71a6512d0e17bdd183feb0"
+
+		# 3.0.8 -> 3.0.9
+		known_file_308="\
+1cc6a1de93ca357b5c364aa0fa2c4bea\
+f97425686fa1976d436fa31f550641aa"
+
+		# Built-in here-doc 3.2.0
+		known_heredoc_320="\
 82439f1860838e28f6270d5d06b17717\
 56db777861e19bf9edc21222f86a310d"
 
@@ -5459,32 +5474,47 @@ ac05f49595e5d5fe96367229e3ce070c"
 		file_hash="$(
 			OPENSSL_CONF=/dev/null
 			"$EASYRSA_OPENSSL" dgst -sha256 -r "$EASYRSA_SSL_CONF"
-		)" || die "hash malfunction!"
+		)" || warn "hash malfunction!"
 
 		# Strip excess SSL info
 		file_hash="${file_hash%% *}"
 
 		# Compare SSL output
 		case "$file_hash" in
-		*[!1234567890abcdef]*)
-			die "hash failure: $file_hash"
+		*[!1234567890abcdef]*|'')
+			warn "hash failure: $file_hash"
 		esac
 
 		# Check file hash against known hash
+		hash_is_unknown=""
+
 		case "$file_hash" in
-		"$known_hash_file") ;;
-		"$known_hash_heredoc_1") ;;
+		"$known_file_317") ;;
+		"$known_file_315") ;;
+		"$known_file_310") ;;
+		"$known_file_308") ;;
+		"$known_heredoc_320") ;;
+
 		*)
-			# File has been changed, leave in place
-			unset -v file_hash known_hash_file known_hash_heredoc_1
-			verbose "write_easyrsa_ssl_cnf_tmp: SSL config NO CHANGE!"
+			# File is unknown or has been changed, leave in place
+			hash_is_unknown=1
+		esac
+
+		# Cleanup
+		unset -v file_hash  known_heredoc_320 \
+				known_file_317 \
+				known_file_315 \
+				known_file_310 \
+				known_file_308
 
-			# Use the existing and changed file ONLY
+		# Use the existing file ONLY
+		if [ "$hash_is_unknown" ]; then
+			unset -v hash_is_unknown
+			verbose "write_easyrsa_ssl_cnf_tmp: SSL config NO CHANGE!"
 			return 0
-		esac
+		fi
 
-		# Ignore this file, prefer to use a temp-file
-		unset -v file_hash known_hash_file known_hash_heredoc_1
+		# Ignore existing file, prefer to use a temp-file
 		verbose "write_easyrsa_ssl_cnf_tmp: SSL config IGNORED"
 	fi
 

From 5c98e8c2e58452ef05b1dec500f2e10b42a7d8fe Mon Sep 17 00:00:00 2001
From: Richard T Bonhomme <tincantech@protonmail.com>
Date: Sat, 13 Jan 2024 21:05:08 +0000
Subject: [PATCH 31/31] ChangeLog: Remove command 'make-safe-ssl'

Replaced by command 'write safe-cnf'

Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index e7d49c43b..0a3a01c93 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -26,6 +26,7 @@ Easy-RSA 3 ChangeLog
      that both are valid X509-types, until `code-signing` is dropped.
    * init-pki: Always write vars.example file to fresh PKI (66a8f3e)
    * New command 'write': Write 'legacy' files to stdout or files (c814e0a)
+   * Remove command 'make-safe-ssl': Replaced by command 'write safe-cnf' (c814e0a)
    * New Command 'rand': Expose easyrsa_random() to the command line (6131cbf)
    * Remove function 'set_pass_legacy()' (7470c2a)
    * Remove command 'rewind-renew' (72b4079)