Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
easy-rsa - Simple shell based CA utility

gen_req() no longer alters the global EXTRA_EXTS variable

When forming the OpenSSL config replacement text, gen_req() should not
alter the global variable as it is referred to again by sign_req() when
the wrapper-commands build-*-full are called.

This change localizes the replacement text to avoid competing over the
global variable.

Signed-off-by: Josh Cepek <>
Based-On: patch submitted by Joe Hu <>
Fixes: Issue #25
latest commit bc586578b4
Josh Cepek QueuingKoala authored


easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's terms,
this means to create a root certificate authority, and request and sign 
certificates, including sub-CAs and certificate revokation lists (CRL).


If you are looking for release downloads, please see the releases section on
GitHub. Releases are also available as source checkouts using named tags.


For 3.x project documentation and usage, see the file or
the more detailed docs under the doc/ directory. The .md files are in Markdown
format and can be converted to html files as desired for release packages, or
read as-is in plaintext.


Currently, Easy-RSA development co-exists with OpenVPN even though they are
separate projects. The following resources are good places as of this writing to
seek help using Easy-RSA:

The openvpn-users mailing list is a good place to post usage or help questions:

You can also try IRC at Freenode/#openvpn


The easy-rsa master branch is currently tracking development for the 3.x release
cycle. The prior 2.x and 1.x versions are available as release branches for
tracking and possible back-porting of relevant fixes. Branch layout is:

  master <- 3.x, at present

LICENSING info for 3.x is in the COPYING file
Something went wrong with that request. Please try again.