Feature request: Better certificate handling

[gits7r]

It would be nice to have the following more options that will make this script absolutely complete:

1. When running it for the first time (deploying OpenVPN and settings) among the questions about rsa/ec dh/ecdh and curve, we should ask before generating the signing request for CA. This can be done using the var EASYRSA_CA_EXPIRE:

In how many days should the CA expire?
(Note: The CA certificate is authenticating the server and client certificates, thus it MUST have a much larger validity period)
Defaults to 3650 days. 

Here user will enter 1 for default or 2 for custom period.

2. Before generating the server certificate sign request, we should ask for how much it should be valid for. This can be done using the EASYRSA_CERT_EXPIRE var. A message like this to be printed:

In how many days should the server certificate expire?
Defaults to 825 days

Here user will enter 1 for default or 2 for custom period AND if 2, user MUST not be allowed to enter a period greater than (>) period selected fro CA certificate before. Return and ask to enter again the expiration days with notification that it cannot be greater than CA, where CA expires in $ca_days.

Secondly, if script is run the second time (after OpenVPN has been installed), in addition to

• Add a client
• Remove a client
• Uninstall OpenVPN

We should also have:

• List all certificates
  Here we will read the contents of /pki and display all the certificates with their respective CN, serial, expiration time, and days that it can be renewed before its expiration (the EASYRSA_CERT_RENEW value that was used at certificate generation time, currently defaults to 90 days).

After we list this information in a table, among Add a client and Remove a client we should also have Renew a certificate (that should also work for also for SERVER certificate and for clients certificates if they are within their CERT_RENEW time-window) and if selected, ask again for the var EASYRSA_CERT_EXPIRE how much it should be, otherwise fail down to the default.

[gits7r]

Related #1072 that can be closed in favor of this one. If anyone is willing to do this I will send some beers in BTC.

[angristan]

Would love some nice PRs on this!

[TinCanTech]

For the CA: export EASYRSA_CA_EXPIRE=$value
For certs: export EASYRSA_CERT_EXPIRE=$value

Otherwise, use option --days=$value on the command line.

[angristan]

There is this PR that partially tackles this: #1060 but it's not mergeable.

[angristan]

Closing to keep things in #974