BSD Ports

security/easy-rsa 3.2.2,1 DragonFly

Small RSA key management package based on openssl

System
DragonFly
Repository
DPorts
Maintainer
[email protected] (as in FreeBSD)
License
GPLv2
Categories
net-mgmt, security
Package size
72.7 KiB, 284.4 KiB installed

Description

Easy-RSA is a small RSA key management package, based on the openssl command line tool, that can be found in the easy-rsa subdirectory of the OpenVPN distribution. While this tool is primary concerned with key management for the SSL VPN application space, it can also be used for building web certificates.

In the other systems

SystemPortVersion
DragonFlysecurity/easy-rsa3.2.2,1
FreeBSDsecurity/easy-rsa3.2.6,1
OpenBSDsecurity/easy-rsa3.2.7
NetBSDsecurity/easy-rsa3.2.6
MidnightBSDsecurity/easy-rsa3.2.5,1
HardenedBSDsecurity/easy-rsa3.2.6,1
GhostBSDsecurity/easy-rsa3.2.6,1
OPNsensesecurity/easy-rsa3.2.6,1

Install

Binary package:

pkg install easy-rsa

From DPorts:

cd /usr/dports/security/easy-rsa && make install clean

Dependencies

Required by 1

Configuration

No options to configure.

Service scripts
none

Message after installing

NOTE: easyrsa will require you to initialize a PKI upon first use.

ONLY for the very first run for a new PKI, do something such as this,
assuming you will have its data in $HOME/my_new_pki:

  easyrsa --pki-dir=$HOME/my_new_pki init-pki # DANGEROUS - DESTROYS ~/my_new_pki

See /usr/local/share/doc/easy-rsa/README.quickstart.md for further information.

An on-line help is available, you can run:

  easyrsa help          # for help on commands
  easyrsa help options  # for help on options

**** SECURITY WARNING FOR PAST security/easy-rsa versions ****
**** easyrsa may have encrypted your CA private key with a weak cipher

Per CVE-2024-13454, Easy-RSA 3.0.5 inclusively up to and including 3.1.7,
when used with OpenSSL 3, may have accidentally encrypted the CA private
key with a weak cipher, des-ede3-cbc, instead of the intended aes-256-cbc,
when a CA was created with the   easyrsa build-ca   command.

Such mistakes cannot be corrected by upgrading Easy-RSA alone.

The standing recommendation for CA private keys is to 
re-encrypt the CA private keys with the aes-256-cbc cipher,
by using the   easyrsa set-pass ca   command.

For details, see https://community.openvpn.net/openvpn/wiki/CVE-2024-13454.

**** END SECURITY WARNING FOR PAST security/easy-rsa versions ****