In gen-req --batch option generates request with "subject=CN = ChangeMe"

[tik806]

To reproduce:
easyrsa --batch gen-req CertName nopass
and look at it:
openssl req -in CertName.req -noout -subject

But
easyrsa gen-req CertName nopass batch
works fine

[TinCanTech]

Do you mean this ?

tct@home:~/easy-rsa/EasyRSA-3.0.8$ ./easyrsa init-pki

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /home/tct/easy-rsa/EasyRSA-3.0.8/pki


tct@home:~/easy-rsa/EasyRSA-3.0.8$ ./easyrsa --batch gen-req test nopass
Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
Generating a RSA private key
............+++++
...........+++++
writing new private key to '/home/tct/easy-rsa/EasyRSA-3.0.8/pki/easy-rsa-323704.0rfNru/tmp.UrWMVZ'
-----

tct@home:~/easy-rsa/EasyRSA-3.0.8$ openssl req -in pki/reqs/test.req -noout -subject
subject=CN = ChangeMe
tct@home:~/easy-rsa/EasyRSA-3.0.8$ ./easyrsa gen-req fred nopass batch
Using SSL: openssl OpenSSL 1.1.1f  31 Mar 2020
Generating a RSA private key
...........................................+++++
.............................................................................................................................+++++
writing new private key to '/home/tct/easy-rsa/EasyRSA-3.0.8/pki/easy-rsa-323797.UTUdtq/tmp.PTcBYQ'
-----

tct@home:~/easy-rsa/EasyRSA-3.0.8$ openssl req -in pki/reqs/fred.req -noout -subject
subject=CN = fred
tct@home:~/easy-rsa/EasyRSA-3.0.8$ 

[tik806]

Yes, exactly

[u0m3]

You can work around that with something like:

declare -a certnames
certnames=( 'cert1' 'cert2' 'cert3 )

for certname in ${certnames[@]}; do
    ./easyrsa --batch --req-cn=${certname} gen-req ${certname} nopass
    ./easyrsa --batch --req-cn=${certname} sign-req client ${certname} nopass
done

Also +1 for the

easyrsa gen-req CertName nopass batch

version of the command. I had no idea it of it's existence.

[ecrist]

This is a bug for sure. We'll try to address this in v3.0.9.

[TinCanTech]

This comment is completely wrong:

# gen-req backend:
gen_req() {
	# pull filename base and use as default interactive CommonName:

This is what actually happens:

# gen-req backend:
gen_req() {
	# pull filename base and use as default non-interactive CommonName:

This is another case of abusing EASYRSA_BATCH.