[Openvpn-devel] windows installer version uses easy-rsa 1.0

[Daniel Z. <dan...@ya...>]

Hi,

the easy-rsa directory installed by the windows installer comes with the
old easy-rsa 1.0 files. (even current openvpn-2.1_rc2-install.exe)

This bug is not that critical, but it is annoying that easy-rsa still
creates server certificates without extended key usage per default
(openssl.cnf), making the windows user wonder about error messages if
the recommended "remote-cert-tls" option is used. (In this case simply
copying the openssl.cnf from the 2.0 directory did the job, for regular
usage the path to opensc in the newly added pkcs11 section should be
changed).

And if possible please add the following three files to the "Windows"
directory if easy-rsa. They allow to build password protected versions
of the keys (I just copied the files and remove the "-nodes" parameter).
Except of build-key-server-pass.bat i think that they are vital for
security (e.g. the key files are in an unencrypted directory and
physical access is possible).

build-ca-pass.bat

@echo off
cd %HOME%
rem build a request for a cert that will be valid for ten years
openssl req -days 3650 -new -keyout %KEY_DIR%\%1.key -out
%KEY_DIR%\%1.csr -config %KEY_CONFIG%
rem sign the cert request with our ca, creating a cert/key pair
openssl ca -days 3650 -out %KEY_DIR%\%1.crt -in %KEY_DIR%\%1.csr -config
%KEY_CONFIG%
rem delete any .old files created in this process, to avoid future file
creation errors
del /q %KEY_DIR%\*.old

build-key-pass.bat

@echo off
cd %HOME%
rem build a request for a cert that will be valid for ten years
openssl req -days 3650 -new -keyout %KEY_DIR%\%1.key -out
%KEY_DIR%\%1.csr -config %KEY_CONFIG%
rem sign the cert request with our ca, creating a cert/key pair
openssl ca -days 3650 -out %KEY_DIR%\%1.crt -in %KEY_DIR%\%1.csr -config
%KEY_CONFIG%
rem delete any .old files created in this process, to avoid future file
creation errors
del /q %KEY_DIR%\*.old

build-key-server-pass.bat

@echo off
cd %HOME%
rem build a request for a cert that will be valid for ten years
openssl req -days 3650 -new -keyout %KEY_DIR%\%1.key -out
%KEY_DIR%\%1.csr -config %KEY_CONFIG%
rem sign the cert request with our ca, creating a cert/key pair
openssl ca -days 3650 -out %KEY_DIR%\%1.crt -in %KEY_DIR%\%1.csr
-extensions server -config %KEY_CONFIG%
rem delete any .old files created in this process, to avoid future file
creation errors
del /q %KEY_DIR%\*.old




	
		
___________________________________________________________ 
Der frühe Vogel fängt den Wurm. Hier gelangen Sie zum neuen Yahoo! Mail: http://mail.yahoo.de