Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

init-pki: Add second confirmation to promote use of option 'soft' #1217

Merged
merged 1 commit into from
Aug 19, 2024
Merged

init-pki: Add second confirmation to promote use of option 'soft' #1217

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 23 additions & 4 deletions easyrsa3/easyrsa
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,9 +122,10 @@ Usage: easyrsa [ OPTIONS.. ] <COMMAND> <TARGET> [ cmd-opts.. ]"
Removes & re-initializes the PKI directory for a new PKI"

opts="
* hard - Recursively delete the PKI directory (default).
* soft - Keep the named PKI directory and PKI 'vars' file
intact."
* hard - Recursively delete the ENTIRE PKI directory (default).
* soft - Keep the named PKI directory and PKI 'vars' file intact.
Also keep the current Request files,
to be signed by a new CA (Partial CA renewal)."
;;
self-sign*)
text="
Expand Down Expand Up @@ -1414,14 +1415,32 @@ and initialize a fresh PKI here."
# now remove it:
case "$reset" in
hard)
# Promote use of 'init-pki soft':
confirm "
WARNING: COMPLETELY DESTROY current PKI (NOT recommended) ?

[yes/NO]: " yes "\
******************************************
* SECOND WARNING - STOP - SECOND WARNING *
******************************************

To keep your current 'pki/vars' settings use 'init-pki soft'.
To keep your current Request files use 'init-pki soft'
The Requests can then be signed by a new CA (Partial CA renewal)

** USE OF 'init-pki soft' IS RECOMMENDED **
"


# # # shellcheck disable=SC2115 # Use "${var:?}"
rm -rf "$EASYRSA_PKI" || \
die "init-pki hard reset failed."
;;
soft)
# There is no unit test for a soft reset
# Do NOT remove pki/reqs sub-dir, for "renew ca"
for i in ca.crt crl.pem \
issued private reqs inline revoked renewed \
issued private inline revoked renewed expired \
serial serial.old index.txt index.txt.old \
index.txt.attr index.txt.attr.old \
ecparams certs_by_serial
Expand Down