`build-ca`, password cannot use `$` character about easy-rsa HOT 9 CLOSED

Hi,

I created my ca and certificates succesfully following your tips (raw-ca and escaping $ char).

Thank you very much for your support

Roberto

from easy-rsa.

@PWnet Thank you for this issue - I confirm this is a bug.

Investigating ..

For testing purposes, can you try the command:

easyrsa --raw-ca build-ca

with your long password, which appears to work for me.

Also, which version of openssl are you using ?

from easy-rsa.

@PWnet You must escape the $ character when inputting the password, to use the standard easyrsa method to build-ca.

from easy-rsa.

This could probably be done without the need to escape a $ sign.

from easy-rsa.

Easy-RSA v3.2.0 is not effected by this issue.

from easy-rsa.

@PWnet Thank you for this issue - I confirm this is a bug.

Investigating ..

For testing purposes, can you try the command:

easyrsa --raw-ca build-ca

with your long password, which appears to work for me.

Also, which version of openssl are you using ?

I'm using openssl 3.0.2 on ubuntu 22.04, but I have the same issue with easy-rsa 3.1.7 for windows that uses the recommended version.

IMHO a password input field should accept special characters without escaping (like openssl or easy-rsa 2.x I used to create my old certificates).

Anyway I tried with escaped character and It works (at least with the ca).

I give a try with version 3.2.0.

Regards

from easy-rsa.

You can also try the --raw-ca option with v3.1.7, as above, which does not require $ sign to be escaped.

from easy-rsa.

FTR:
Easy-RSA v3 has never supported $ sign in the CA password. build-ca
This is due to shell expansion.

Since v3.1.7, that is resolved, only for build-ca
Using raw exposure to the SSL executable. Easy-RSA option --raw-ca mode for command build-ca only.

Otherwise, passing options to easyrsa is still subject to shell expansion, which still requires some escaping and some more escaping (due to easyrsa extra expansion via set_var()) for org-field options, such as --req-ou which want to use $.

And on top of that, there is the shell expansion for use of $ in the vars file ... and backward compatibility ... and sufficient testing.

Thanks for helping by testing.

from easy-rsa.

Thank you for testing and feeding back your results.

Closing this now because, even though this could be called a bug, it has always been that way and there is a work around for v3.1.7, --raw-ca option.

from easy-rsa.