Home / server / Questions / 835764
In Process
TCB13
Asked: 2017-03-02 16:30:10 +0800 CST

OpenVPN easy-rsa: Common Name set at vars

  • 772

I got the latest version (3.0.1) of the easy-rsa tool from Github in order to generate some certificates for a small VPN. After looking into the documentation I manage to write a vars file that include answers to most questions made by the tool including setting the Common Name:

set_var EASYRSA_REQ_CN          "vpn.machine.dev"

Every other option os correctly loaded / takes the value I set on vars by the easy-rsa tool however EASYRSA_REQ_CN seems to be ignored. Here is an example:

Organizational Unit Name (eg, section) [IT]:
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
Email Address [[email protected]]:

Why isn't Common Name using the value I set and is defaulting to [Easy-RSA CA]? What did I miss?

Thank you!

openvpn

2 Answers

  1. I just had a quick look at easy-rsa source code I found this:

    # Default CN only when not in global EASYRSA_BATCH mode:
    [ $EASYRSA_BATCH ] && opts="$opts -batch" || export EASYRSA_REQ_CN="Easy-RSA CA"

    Apparently it will just ignore EASYRSA_REQ_CN when not running in batch mode (EASYRSA_BATCH). This must be some by-design decision that goes out of my understanding of the tool.

    For anyone facing the same issue, adding the following to your vars will fix this:

    set_var EASYRSA_BATCH       "yes"

    WARNING: when running in batch mode the tool won't ask for ANY user input and might destroy previous information / generate errors. Test your config before using this mode.

    • 3

  2. I assume that you want to generate a certificate request. I'm using EasyRSA 3.0.6 this way:

    EASYRSA_REQ_CN=vpn.machine.dev ./easyrsa --batch gen-req vpn.machine.dev nopass
    • 0