Skip to content

Instantly share code, notes, and snippets.

@jeffscrum

jeffscrum/easyrsa.sh

Forked from QueuingKoala/setup.sh
Last active June 5, 2025 15:22
Show Gist options
  • Save jeffscrum/4bac3fa4a1b3953150b67e04fb9efcf6 to your computer and use it in GitHub Desktop.
Save jeffscrum/4bac3fa4a1b3953150b67e04fb9efcf6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. jeffscrum revised this gist Jun 5, 2025. 1 changed file with 5 additions and 0 deletions.
    5 changes: 5 additions & 0 deletions easyrsa.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -21,6 +21,11 @@ cp offline/issued/sub.crt sub/ca.crt
    # Real-world use should import a CSR from the actual clients. We don't for brevity here.
    EASYRSA_PKI=sub easyrsa gen-req server nopass
    EASYRSA_PKI=sub easyrsa gen-req client nopass
    # ./easyrsa sign-req <type> nameOfRequest
    # client - A TLS client, suitable for a VPN user or web browser (web client)
    # server - A TLS server, suitable for a VPN or web server
    # ca - A intermediate CA, used when chaining multiple CAs together
    # serverClient - A TLS server and TLS client
    EASYRSA_PKI=sub easyrsa sign-req server server
    EASYRSA_PKI=sub easyrsa sign-req client client

  2. jeffscrum renamed this gist Jun 5, 2025. 1 changed file with 18 additions and 1 deletion.
    19 changes: 18 additions & 1 deletion setup.sh → easyrsa.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -31,4 +31,21 @@ cat sub/issued/client.crt sub/ca.crt > client-bundle.crt
    # Full chain (server cert + Intermediate + Root)
    cat sub/issued/server.crt \
    sub/ca.crt \
    offline/ca.crt > server.full-chain.crt
    offline/ca.crt > server.full-chain.crt

    # Create an updated CRL that contains all revoked certs up to that point
    EASYRSA_PKI=sub easyrsa gen-crl

    # Revoke cert
    # Values accepted for option [ reason ]:
    # us | uns* | unspecified
    # kc | key* | keyCompromise
    # cc | ca* | CACompromise
    # ac | aff* | affiliationChanged
    # ss | sup* | superseded
    # co | ces* | cessationOfOperation
    # ch | cer* | certificateHold

    #EASYRSA_PKI=sub easyrsa revoke-issued <file_name_base> [ reason ] # Revoke a current, issued certificate.
    #EASYRSA_PKI=sub easyrsa revoke-expired <file_name_base> [ reason ] # Revoke an old, expired certificate.
    #EASYRSA_PKI=sub easyrsa revoke-renewed <file_name_base> [ reason ] # Revoke an old, renewed certificate.
  3. jeffscrum revised this gist Jun 5, 2025. 1 changed file with 7 additions and 2 deletions.
    9 changes: 7 additions & 2 deletions setup.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -24,6 +24,11 @@ EASYRSA_PKI=sub easyrsa gen-req client nopass
    EASYRSA_PKI=sub easyrsa sign-req server server
    EASYRSA_PKI=sub easyrsa sign-req client client

    # Finally, create "bundle" files for use at each entity (ie: server and client ends.)
    # Server bundle (server or client cert + Intermediate CA cert)
    cat sub/issued/server.crt sub/ca.crt > server-bundle.crt
    cat sub/issued/client.crt sub/ca.crt > client-bundle.crt
    cat sub/issued/client.crt sub/ca.crt > client-bundle.crt

    # Full chain (server cert + Intermediate + Root)
    cat sub/issued/server.crt \
    sub/ca.crt \
    offline/ca.crt > server.full-chain.crt
  4. jeffscrum revised this gist Jun 5, 2025. 1 changed file with 10 additions and 10 deletions.
    20 changes: 10 additions & 10 deletions setup.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -3,26 +3,26 @@
    # A real-world setup would use different systems and transport the public components.

    # Build root CA:
    EASYRSA_PKI=offline ./easyrsa init-pki
    EASYRSA_PKI=offline ./easyrsa build-ca nopass
    EASYRSA_PKI=offline easyrsa init-pki
    EASYRSA_PKI=offline easyrsa build-ca nopass

    # Build sub-CA request:
    EASYRSA_PKI=sub ./easyrsa init-pki
    EASYRSA_PKI=sub ./easyrsa build-ca nopass subca
    EASYRSA_PKI=sub easyrsa init-pki
    EASYRSA_PKI=sub easyrsa build-ca nopass subca

    # Import the sub-CA request under the short-name "sub" on the offline PKI:
    EASYRSA_PKI=offline ./easyrsa import-req sub/reqs/ca.req sub
    EASYRSA_PKI=offline easyrsa import-req sub/reqs/ca.req sub
    # Then sign it as a CA:
    EASYRSA_PKI=offline ./easyrsa sign-req ca sub
    EASYRSA_PKI=offline easyrsa sign-req ca sub
    # Transport sub-CA cert to sub PKI:
    cp offline/issued/sub.crt sub/ca.crt

    # Generate and sign some requests on the sub-CA.
    # Real-world use should import a CSR from the actual clients. We don't for brevity here.
    EASYRSA_PKI=sub ./easyrsa gen-req server nopass
    EASYRSA_PKI=sub ./easyrsa gen-req client nopass
    EASYRSA_PKI=sub ./easyrsa sign-req server server
    EASYRSA_PKI=sub ./easyrsa sign-req client client
    EASYRSA_PKI=sub easyrsa gen-req server nopass
    EASYRSA_PKI=sub easyrsa gen-req client nopass
    EASYRSA_PKI=sub easyrsa sign-req server server
    EASYRSA_PKI=sub easyrsa sign-req client client

    # Finally, create "bundle" files for use at each entity (ie: server and client ends.)
    cat sub/issued/server.crt sub/ca.crt > server-bundle.crt
  5. @QueuingKoala QueuingKoala revised this gist May 9, 2014. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion setup.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -4,7 +4,7 @@

    # Build root CA:
    EASYRSA_PKI=offline ./easyrsa init-pki
    EASYRSA_PKI=offline ./easyrsa init-ca nopass
    EASYRSA_PKI=offline ./easyrsa build-ca nopass

    # Build sub-CA request:
    EASYRSA_PKI=sub ./easyrsa init-pki
  6. @QueuingKoala QueuingKoala created this gist May 9, 2014.
    29 changes: 29 additions & 0 deletions setup.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,29 @@
    # Assumptions: easyrsa3 available in current dir, and functional openssl.
    # This basic example puts the "offline" and "sub" PKI dirs on the same system.
    # A real-world setup would use different systems and transport the public components.

    # Build root CA:
    EASYRSA_PKI=offline ./easyrsa init-pki
    EASYRSA_PKI=offline ./easyrsa init-ca nopass

    # Build sub-CA request:
    EASYRSA_PKI=sub ./easyrsa init-pki
    EASYRSA_PKI=sub ./easyrsa build-ca nopass subca

    # Import the sub-CA request under the short-name "sub" on the offline PKI:
    EASYRSA_PKI=offline ./easyrsa import-req sub/reqs/ca.req sub
    # Then sign it as a CA:
    EASYRSA_PKI=offline ./easyrsa sign-req ca sub
    # Transport sub-CA cert to sub PKI:
    cp offline/issued/sub.crt sub/ca.crt

    # Generate and sign some requests on the sub-CA.
    # Real-world use should import a CSR from the actual clients. We don't for brevity here.
    EASYRSA_PKI=sub ./easyrsa gen-req server nopass
    EASYRSA_PKI=sub ./easyrsa gen-req client nopass
    EASYRSA_PKI=sub ./easyrsa sign-req server server
    EASYRSA_PKI=sub ./easyrsa sign-req client client

    # Finally, create "bundle" files for use at each entity (ie: server and client ends.)
    cat sub/issued/server.crt sub/ca.crt > server-bundle.crt
    cat sub/issued/client.crt sub/ca.crt > client-bundle.crt