easy-rsa icon indicating copy to clipboard operation
easy-rsa copied to clipboard

RFE: Convenience function to export Certificates as pem / der encoded bundle

Open dekeonus opened this issue 3 years ago • 0 comments

It would be convenient to have a function to bundle the certificate chain into a single file for easier deployment for software expecting a pem bundle (and less likely a der encoded certificate).

Repeating the options available to the other export modules noca nokey and nopass would enable the common bundles typically used: private key and cert with full chain, cert and full chain, key and cert.

If subCAs are used it may not be possible to provide a full chain. It could be achieved with command options to point to the superior certificate or perhaps requiring the subCA to have it's full-chain cert be exported from the superior CA before being able to issue it's own full-chain exports.

The current export functions use either issued/ or private/ for the output location, for this suggested export function those directories seem inappropriate and a required command line output path / filename might be a better fit.

If the export is performed on certificates using easyrsa_openssl x509 -in [path/cert] -outform PEM >> [outpath/cert_bundle] the text will be stripped from the output certificates leaving just pem encoded (and concatenated) certificates. This would resolve #624 Care would need to be taken to ensure a file wasn't already at the output location.

For a der export I suspect only the singular certificate is wanted (and I'm not aware of any extant software that can read a der bundle)

dekeonus avatar Aug 08 '22 00:08 dekeonus