EASYRSA_KEY_SIZE, EASYRSA_DIGEST in vars is ignored

[bsaner]

(Please see the ​ associated github issue )

easyrsa ignores both EASYRSA_KEY_SIZE in vars...:

[root@g bdisk]# grep KEY vars
set_var EASYRSA_KEY_SIZE        4096
[root@g bdisk]# easyrsa init-pki && yes '' | easyrsa build-ca nopass

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/servers/keygen/bdisk/pki

Generating a 2048 bit RSA private key
...+++
.............+++
writing new private key to '/etc/openvpn/servers/keygen/bdisk/pki/private/ca.key.Orh3ijGp3Z'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/servers/keygen/bdisk/pki/ca.crt

[root@g bdisk]# openssl rsa -in pki/private/ca.key -noout -text | head -n1
Private-Key: (2048 bit)

and EASYRSA_DIGEST in vars:

[root@g bdisk]# grep DIGEST vars
set_var EASYRSA_DIGEST          "sha512"
[root@g bdisk]# openssl x509 -in pki/ca.crt -noout -text | grep 'Signature Algorithm'
    Signature Algorithm: sha256WithRSAEncryption
    Signature Algorithm: sha256WithRSAEncryption

As a sidenote, if you use Trac for bugs, you should either have a member focused on watching GitHub? Issues for new reports or simply disable Issues on GH- otherwise it gives the impression that you are ignoring bug reports.

[bsaner]

(I should note if you'd like to rewrite easyrsa in python, I recently wrote a PKI creation implementation viewable ​ here . It may prove to be less painful than bash, albeit it requires a non-STDLIB module.)

[Gert Döring]

Not sure about easy-rsa 3.x - but in older versions, you need to source "vars" from the shell *before* running any of the
scripts, as in

$ . ./vars
$ ./build-key foobar

maybe that's still the same? (Note the "." in front of the "./vars" = "execute in local shell")

[debbie10t]

I have generated dozens of test PKIs and can not replicate this problem.
If $PWD/vars contains set_var EASYRSA_KEY_SIZE 4096 then I get a 4096bit PKI.

In the github report above, I notice the commands in use are:
$ easyrsa foo bar
or
# easyrsa foo bar

For my tests, from $PWD , I use the command:
$ ./easyrsa foo bar

[deepthought]

"For my tests, from $PWD, I use the command:
$ ./easyrsa foo bar"

well, this is exactly the important difference: The vars file is not sourced if it's in the working directory or in pki/ -- only if it's e.g. also in the directory of the executable. However, many distributions ship easyrsa with its binary in /usr/bin/.
Have a look here:
​ https://github.com/OpenVPN/easy-rsa/issues/119
and here:
​ https://github.com/OpenVPN/easy-rsa/pull/120

[tct]

It seems to me that this issue has been adequately addressed.

From easyrsa3/vars.example

# NOTE: If you installed Easy-RSA from your distro's package manager, don't edit
# this file in place -- instead, you should copy the entire easy-rsa directory
# to another location so future upgrades don't wipe out your changes.

[Eric Crist]

Closing this ticket - we only need a ticket in either the EasyRSA project on github (preferred), or here. We'll handle this one on github.