Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- easyrsa [21/11/2023 - 16:00] – admin
+++ easyrsa [21/11/2023 - 16:01] – admin
@@ Zeile 25: / Zeile 25: @@
 ===== Importieren =====
 <code>
-''./easyrsa import-req /path/
-to /
+''./easyrsa import-req /path/to /request .req nameOfRequest''
-request .req nameOfRequest''
 </code>
 ===== Signieren (client oder server) =====
-''./easyrsa sign-req client EntityName '''' '' \\
+''./easyrsa sign-req client EntityName '' \\
-''./easyrsa sign-req server EntityName ''
+''./easyrsa sign-req server EntityName
 ===== Zertifikats Inhalt anzeigen =====
-''./easyrsa show-req EntityName ''
+''./easyrsa show-req EntityName
-''./easyrsa show-cert EntityName ''
+''./easyrsa show-cert EntityName
 Alternativ direkt mit openssl
@@ Zeile 71: / Zeile 71: @@
 Key Passwörter ändern
-''./easyrsa set-rsa-pass EntityName ''
+''./easyrsa set-rsa-pass EntityName
-''./easyrsa set-ec-pass EntityName ''
+''./easyrsa set-ec-pass EntityName
 Mit "nopass" wird ein Passwort entfernt
@@ Zeile 79: / Zeile 79: @@
 **CSR**
-''openssl req -in www2.netzwissen.de.csr -text -noout ''
+''openssl req -in www2.netzwissen.de.csr -text -noout
 **Zertifikat**
-''openssl x509 -in certificate.crt -text -noout ''
+''openssl x509 -in certificate.crt -text -noout
 ===== Zertifikat zurückziehen =====
@@ Zeile 114: / Zeile 114: @@
 Validierung über common name (alte Methode): Der Common Name für das Server Zertifikat muss den Präfix aus der Server Config enthalten:
-''–verify-x509-name openvpn name-prefix ''
+''–verify-x509-name openvpn name-prefix
 Mit easyrsa3:
-''locutus:~/easy-rsa/easyrsa3''
+''locutus:~/easy-rsa/easyrsa3
-''./easyrsa sign-req server openvpn.locutus.netzwissen.loc''
+''./easyrsa sign-req server openvpn.locutus.netzwissen.loc
 **Neue Methode nach RFC3280: Verifikation nach Zertifikatstyp**:
-''remote-cert-tls client ''
+''remote-cert-tls client
-''./easyrsa sign-req client franklin2.netzwissen.loc''
+''./easyrsa sign-req client franklin2.netzwissen.loc
 Im Client wird im Gegenzug geprüft, ob das vom OpenVPN Server präsentierte Zertifikat den "server" Typ hat
@@ Zeile 133: / Zeile 133: @@
 ''pkitool –initca → Build root certificate\\
-pkitool ''''–initca –pass → Build root certificate with password-protected key\\
+pkitool ''–initca –pass → Build root certificate with password-protected key\\
 pkitool –server server1 → Build "server1" certificate/key\\
 pkitool client1 → Build "client1" certificate/key\\
@@ Zeile 141: / Zeile 141: @@
 pkitool –sign client4 → Sign "client4" CSR\\
 pkitool –inter interca → Build an intermediate key-signing certificate/key Also see ./inherit-inter script.\\
-pkitool –pkcs11 /usr/lib/pkcs11/lib1 0 010203 "client5 id" client5 → Build "client5" certificate/key in PKCS#11 token ''
+pkitool –pkcs11 /usr/lib/pkcs11/lib1 0 010203 "client5 id" client5 → Build "client5" certificate/key in PKCS#11 token
 Typical usage for initial PKI setup. Build myserver, client1, and client2 cert/keys. Protect client2 key with a password. Build DH parms. Generated files in ./keys :
-''[edit vars with your site-specific info] '''' source ./vars ./clean-all ./build-dh → takes a long time, consider backgrounding ./pkitool –initca ./pkitool –server myserver ./pkitool client1 ./pkitool –pass client2 ''
+''[edit vars with your site-specific info] '' source ./vars ./clean-all ./build-dh → takes a long time, consider backgrounding ./pkitool –initca ./pkitool –server myserver ./pkitool client1 ./pkitool –pass client2
 Typical usage for adding client cert to existing PKI:
-''source ./vars ./pkitool client-new ''
+''source ./vars ./pkitool client-new