Libressl, Expected to find openssl command at: openssl #74

technonerd33 · 2015-09-17T21:21:49Z

I am trying to get easy-rsa3 to work with libressl on gentoo

openssl version

LibreSSL 2.2.3

./easyrsa init-pki

...
"$EASYRSA_OPENSSL" version
++ openssl version
1385875132:error:0E065068:configuration file routines:STR_COPY:variable has no value:/var/tmp/portage/dev-libs/libressl-2.2.3/work/libressl-2.2.3/crypto/conf/conf_def.c:573:line 3

local val=
case "${val%% *}" in
die 'Missing or invalid OpenSSL
Expected to find openssl command at: openssl'
print '

Changing EASYRSA_OPENSSL to /usr/bin/openssl produces the same error.

sseekamp · 2015-10-19T17:18:37Z

I'm having the same issue with OpenBSD 5.8 and Libre 2.2.2

ecrist · 2015-10-26T03:54:38Z

There has been no testing with LibreSSL at this time. I'm certainly open to feed back and bug testing, however.

ppunosevac · 2015-10-26T14:33:43Z

Easy-rsa works with LibreSSL for me on OpenBSD 5.8. However one has to hard-code info into openssl.cnf as $ENV is not allowed to be passed to libressl. I just open another issue with that.

ecrist · 2016-02-24T17:41:35Z

EasyRSA has only been written to support OpenSSL at this point. Inclusion of another SSL library and set of utilities will be complicated and regression testing will be tough. Moving this to 4.x. Honestly, I don't see it happening unless someone else steps in.

comio · 2016-09-01T07:32:55Z

4.x? LibreSSL is going to be the default for a lot of distros.
I hope to see the support before the 4.x.

ecrist · 2016-09-01T18:34:47Z

Can you cite sources?

Eric

On Sep 1, 2016, at 2:32 AM, comio [email protected] wrote:

4.x? LibreSSL is going to be the default for a lot of distros.
I hope to see the support before the 4.x.

—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub, or mute the thread.

gtozzi · 2016-12-26T10:50:45Z

Same issue here on OpenBSD 6.0

rebbdohr · 2017-02-21T13:29:55Z

Any updates on this thread? Im using OpenBSD 6.0 and the newest easy-rsa version from github, in the easy-rsa script I recognize, that LibreSSL is mentioned, but it still doesnt work. In other OpenBSD related threads they say its because the use of the $ENV variable is deprecated and should not be used...

# Verify EASYRSA_OPENSSL command gives expected output if [ -z "$EASYRSA_SSL_OK" ]; then local val="$("$EASYRSA_OPENSSL" version)" case "${val%% *}" in OpenSSL|LibreSSL) ;; *) die "\ Missing or invalid OpenSSL Expected to find openssl command at: $EASYRSA_OPENSSL" esac fi

For all interested in this topic: the pkg version of easy-rsa on OpenBSD 6.0 is working properly!

rebbdohr · 2017-02-21T13:35:29Z

See also #76

ecrist · 2017-02-22T01:37:11Z

Hello, I have not had a chance to look at this. Unfortunately, the person that wrote 3.0 isn’t active any longer and I’ll need to do a larger review. Hind sight is 20/20. I’ll try to get to it soon. Eric

…

On Feb 21, 2017, at 07:35:30, Randolf Kevin Meier ***@***.***> wrote: See also #76 <#76> — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#74 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABt4P_ToLfDIy5sogai2wIUWpassjf8Uks5reugigaJpZM4F_ePA>.

neilabdev · 2017-08-30T12:29:46Z

+1 FreeBSD 11.1 :)

hiroyuki-sato · 2017-10-06T05:12:43Z

+1 macOS high Sierra (10.13) #155

noizo · 2017-10-06T08:23:29Z

As a workaround for MacOS Sierra/High Sierra add to your ENV this:

export EASYRSA_OPENSSL="/usr/local/Cellar/openssl/1.0.2l/bin/openssl"

hiroyuki-sato · 2017-10-06T08:42:59Z

@noizo Thank you for your reply.

neuhalje · 2017-10-08T08:50:20Z

To make the fix of @noizo "permanent" create or edit the vars file and add set_var EASYRSA_OPENSSL "/usr/local/Cellar/openssl/1.0.2l/bin/openssl" (reference: vars.example ).

dwt · 2017-11-20T10:55:14Z

Same problem on OS X - I workarounded it by adding this to my vars file:

# workaround for https://github.com/OpenVPN/easy-rsa/issues/74 libressl doesn't support passing in values via ENV
if [ ! -z $(brew --prefix) ] ; then 
    export EASYRSA_OPENSSL="$(brew list openssl|grep 'openssl$')"
fi

To retain usability on multiple machines / platforms (not great, but at least it doesn't break immediately.

ilium007 · 2017-12-24T06:27:44Z

Still getting errors on OSX High Sierra even with the EASYRSA_OPENSSL env var declared. The pki/extensions.temp file referred to in the error doesn't even exist.

04:25 pm xxxx@MBA72986 ~/support/tmp/easy-rsa/easyrsa3
$ ./easyrsa build-server-full server nopass

Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
..........+++
..........................+++
writing new private key to '/Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/private/server.key.IhiGDNWXaT'
-----
Using configuration from ./openssl-easyrsa.cnf
Enter pass phrase for /Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/private/ca.key:
ERROR: on line 16 of config file '/Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/extensions.temp'
140735596974984:error:0E079065:configuration file routines:DEF_LOAD_BIO:missing equal sign:conf_def.c:351:line 16

Easy-RSA error:

signing failed (openssl output above may have more detail)
04:25 pm xxxx@MBA72986

Using easyrsa v3.0.4:

$ git status
On branch v3.0.4
Your branch is up-to-date with 'origin/v3.0.4'.

ilium007 · 2017-12-24T06:59:17Z

I removed the pki directory and ran it all again and got a different error:

$ ./easyrsa build-server-full server1 nopass

Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
......+++
.............................................................+++
writing new private key to '/Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/private/server1.key.bdtZ2XZ2ok'
-----
Using configuration from ./openssl-easyrsa.cnf
Enter pass phrase for /Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/private/ca.key:
ERROR: on line 16 of config file '/Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/extensions.temp'
140735596974984:error:02001002:system library:fopen:No such file or directory:bss_file.c:175:fopen('/Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/index.txt.attr','rb')
140735596974984:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:182:
140735596974984:error:0E078072:configuration file routines:DEF_LOAD:no such file:conf_def.c:201:
140735596974984:error:0E079065:configuration file routines:DEF_LOAD_BIO:missing equal sign:conf_def.c:351:line 16

Easy-RSA error:

signing failed (openssl output above may have more detail)

ilium007 · 2017-12-24T07:46:21Z

Exactly the same think happened when I ran this on a raspberry pi (Raspbian GNU/Linux 9 (stretch))

root@raspberrypi:/apps/openvpn/easy-rsa/easyrsa3# ./easyrsa sign-req server server

Note: using Easy-RSA configuration from: ./vars


You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 3650 days:

subject=
    commonName                = server


Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes
Using configuration from ./openssl-easyrsa.cnf
Enter pass phrase for /apps/openvpn/easy-rsa/easyrsa3/pki/private/ca.key:
Can't open /apps/openvpn/easy-rsa/easyrsa3/pki/index.txt.attr for reading, No such file or directory
1996400032:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:74:fopen('/apps/openvpn/easy-rsa/easyrsa3/pki/index.txt.attr','r')
1996400032:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:81:
ca: Error on line 16 of config file "/apps/openvpn/easy-rsa/easyrsa3/pki/extensions.temp"
1996400032:error:0E079065:configuration file routines:def_load_bio:missing equal sign:../crypto/conf/conf_def.c:300:line 16

Easy-RSA error:

signing failed (openssl output above may have more detail)
root@raspberrypi:/apps/openvpn/easy-rsa/easyrsa3#

ilium007 · 2017-12-24T10:04:24Z

Definitely a bug here - just tried on an O/S (14.04.3 LTS, Trusty Tahr) that I have used EasyRSA on in the past and it fails with the same error.

xxxx@xxxx:~/easy-rsa/easyrsa3$ ./easyrsa build-server-full server nopass
Generating a 2048 bit RSA private key
.............................................................................................................................+++
....................................+++
writing new private key to '/home/xxxx/easy-rsa/easyrsa3/pki/private/server.key.aGeIRduxeo'
-----
Using configuration from ./openssl-easyrsa.cnf
Enter pass phrase for /home/xxxx/easy-rsa/easyrsa3/pki/private/ca.key:
ERROR: on line 16 of config file '/home/xxxx/easy-rsa/easyrsa3/pki/extensions.temp'
3074406076:error:02001002:system library:fopen:No such file or directory:bss_file.c:169:fopen('/home/xxxx/easy-rsa/easyrsa3/pki/index.txt.attr','rb')
3074406076:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:172:
3074406076:error:0E078072:configuration file routines:DEF_LOAD:no such file:conf_def.c:197:
3074406076:error:0E079065:configuration file routines:DEF_LOAD_BIO:missing equal sign:conf_def.c:362:line 16

Easy-RSA error:

signing failed (openssl output above may have more detail)
xxxx@xxxx:~/easy-rsa/easyrsa3$ uname -a
Linux xxxx 3.13.0-57-generic #95-Ubuntu SMP Fri Jun 19 09:27:48 UTC 2015 i686 i686 i686 GNU/Linux
xxxx@xxxx:~/easy-rsa/easyrsa3$ cat /etc/os-release
NAME="Ubuntu"
VERSION="14.04.3 LTS, Trusty Tahr"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 14.04.3 LTS"
VERSION_ID="14.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"

ilium007 · 2017-12-24T12:41:02Z

Problem is in the pki/extensions.temp file that is written during cert creation:

Line 16 in that file:

default_server_san /Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/reqs/server06.req

The error pointed to a missing "=" sign. I tried adding this so it was like the other x509 declarations made in the same file but I got more errors:

$ ./easyrsa build-server-full server11 nopass

Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
...........................+++
.....+++
writing new private key to '/Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/private/server11.key.enzOJXHKD4'
-----
Using configuration from ./openssl-easyrsa.cnf
Enter pass phrase for /Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server11'
ERROR: adding extensions in section default
140735596974984:error:22097082:X509 V3 routines:DO_EXT_NCONF:unknown extension name:v3_conf.c:125:
140735596974984:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=default_server_san, value=/Users/xxxx/support/tmp/easy-rsa/easyrsa3/pki/reqs/server11.req

Easy-RSA error:

signing failed (openssl output above may have more detail)

I then initiated creating another server cert and before entering the CA signing password I deleted the line all-together in pki/extensions.temp and it issued the cert as expected.

There is something wrong with the x509 default_server_san extension declaration.

You can see also from the easyrsa help text that the string easyrsa is trying to add in the default_server_san field is nothing like what is expected:

$ ./easyrsa help altname

Note: using Easy-RSA configuration from: ./vars

  --subject-alt-name=SAN_FORMAT_STRING
      This global option adds a subjectAltName to the request or issued
      certificate. It MUST be in a valid format accepted by openssl or
      req/cert generation will fail. Note that including multiple such names
      requires them to be comma-separated; further invocations of this
      option will REPLACE the value.

      Examples of the SAN_FORMAT_STRING shown below:
        DNS:alternate.example.net
        DNS:primary.example.net,DNS:alternate.example.net
        IP:203.0.113.29
        email:[email protected]

ilium007 · 2017-12-24T12:56:45Z

If I specify --subject-alt-name during server cert creation the code seems to work (ie. adds the "=") but there is something with the x509 extension that fails:

$ ./easyrsa --subject-alt-name=test12 build-server-full server12 nopass

Note: using Easy-RSA configuration from: ./vars
Error Loading request extension section req_extra
140735596974984:error:2207507C:X509 V3 routines:v2i_GENERAL_NAME_ex:missing value:v3_alt.c:541:
140735596974984:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=subjectAltName, value=test12

Easy-RSA error:

Failed to generate request

ilium007 · 2017-12-24T13:03:14Z

So after wasting a whole afternoon on this I found the fix in a fork of this code:

TinCanTech@6914461

Tested and works.

nikordaris · 2018-04-15T17:01:06Z

So none of the above worked for me. I had to modify vars and replace:

 export OPENSSL="openssl"

with

export OPENSSL="/usr/local/Cellar/openssl/1.0.2o_1/bin/openssl"

bhall7 · 2018-05-16T02:18:19Z

I'm also struggling to get easy-rsa to work on macOS 10.13.4 which is bundled with LibreSSL. The only problem is that /usr/local/Cellar/openssl/1.0.2l/bin/openssl doesn't seem to exist (nor does the folder /usr/local/Cellar on my machine, for that matter, running macOS 10.13.4). I even tried installing the latest version of OpenSSL, but that failed also. There's got to be a better, easier way to generate OpenVPN certs and keys.

ecrist · 2018-05-16T02:50:34Z

I’ll take a look at this. I do much of the latest development on OS X. Eric Crist

…

On May 15, 2018, at 9:18 PM, Brian Hall ***@***.***> wrote: I'm also struggling to get easy-rsa to work on macOS 10.13.4 which is bundled with LibreSSL. The only problem is that /usr/local/Cellar/openssl/1.0.2l/bin/openssl doesn't seem to exist (nor does the folder /usr/local/Cellar on my machine, for that matter, running macOS 10.13.4). I even tried installing the latest version of OpenSSL, but that failed also. There's got to be a better, easier way to generate OpenVPN certs and keys. — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub, or mute the thread.

SundialServices · 2018-07-26T18:29:39Z

ericst, now that High Sierra has switched to Libre, and many Linux distress are apparently now doing the same, it has become critical that EasyRSA must have a way to support it.

Merge branch 'TinCanTech-libressl' This may also resolve the following issues: #130: cmd-opts nopass doesn't work #76: LibreSSL exposes misuse of $ENV #74: LibreSSL, Expected to find openssl command at: openssl #34: unexpected EOF when using init-pki on OSX 10.9 Signed-off-by: Eric F Crist <[email protected]>

ecrist · 2018-08-23T22:12:05Z

This should be resolved in 93b0f2e

Merge branch 'TinCanTech-libressl' This may also resolve the following issues: OpenVPN#130: cmd-opts nopass doesn't work OpenVPN#76: LibreSSL exposes misuse of $ENV OpenVPN#74: LibreSSL, Expected to find openssl command at: openssl OpenVPN#34: unexpected EOF when using init-pki on OSX 10.9 Signed-off-by: Eric F Crist <[email protected]>

ecrist self-assigned this Oct 26, 2015

ecrist added the enhancement label Oct 26, 2015

ecrist added this to the 3.1 branch milestone Oct 26, 2015

ecrist modified the milestones: 4.x Branch, 3.1 branch Feb 24, 2016

hiroyuki-sato mentioned this issue Oct 6, 2017

easyrsa init subcommand failed on macOS high sierra. #155

Closed

jlucktay mentioned this issue Apr 16, 2018

Improve robustness of certificate setup during e2e cluster creation kubernetes/kubernetes#55229

Closed

ecrist closed this as completed Aug 23, 2018

MaxRenaud mentioned this issue Mar 23, 2021

Update Easy-RSA and CFSSL to support LibreSSL kubernetes-sigs/apiserver-network-proxy#182

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Libressl, Expected to find openssl command at: openssl #74

Libressl, Expected to find openssl command at: openssl #74

technonerd33 commented Sep 17, 2015

sseekamp commented Oct 19, 2015

ecrist commented Oct 26, 2015

ppunosevac commented Oct 26, 2015

ecrist commented Feb 24, 2016

comio commented Sep 1, 2016

ecrist commented Sep 1, 2016

gtozzi commented Dec 26, 2016

rebbdohr commented Feb 21, 2017 •

edited

Loading

rebbdohr commented Feb 21, 2017

ecrist commented Feb 22, 2017 via email

neilabdev commented Aug 30, 2017

hiroyuki-sato commented Oct 6, 2017

noizo commented Oct 6, 2017

hiroyuki-sato commented Oct 6, 2017

neuhalje commented Oct 8, 2017

dwt commented Nov 20, 2017

ilium007 commented Dec 24, 2017 •

edited

Loading

ilium007 commented Dec 24, 2017

ilium007 commented Dec 24, 2017

ilium007 commented Dec 24, 2017 •

edited

Loading

ilium007 commented Dec 24, 2017 •

edited

Loading

ilium007 commented Dec 24, 2017

ilium007 commented Dec 24, 2017 •

edited

Loading

nikordaris commented Apr 15, 2018

bhall7 commented May 16, 2018

ecrist commented May 16, 2018 via email

SundialServices commented Jul 26, 2018

ecrist commented Aug 23, 2018

Libressl, Expected to find openssl command at: openssl #74

Libressl, Expected to find openssl command at: openssl #74

Comments

technonerd33 commented Sep 17, 2015

openssl version

./easyrsa init-pki

sseekamp commented Oct 19, 2015

ecrist commented Oct 26, 2015

ppunosevac commented Oct 26, 2015

ecrist commented Feb 24, 2016

comio commented Sep 1, 2016

ecrist commented Sep 1, 2016

gtozzi commented Dec 26, 2016

rebbdohr commented Feb 21, 2017 • edited Loading

rebbdohr commented Feb 21, 2017

ecrist commented Feb 22, 2017 via email

neilabdev commented Aug 30, 2017

hiroyuki-sato commented Oct 6, 2017

noizo commented Oct 6, 2017

hiroyuki-sato commented Oct 6, 2017

neuhalje commented Oct 8, 2017

dwt commented Nov 20, 2017

ilium007 commented Dec 24, 2017 • edited Loading

ilium007 commented Dec 24, 2017

ilium007 commented Dec 24, 2017

ilium007 commented Dec 24, 2017 • edited Loading

ilium007 commented Dec 24, 2017 • edited Loading

ilium007 commented Dec 24, 2017

ilium007 commented Dec 24, 2017 • edited Loading

nikordaris commented Apr 15, 2018

bhall7 commented May 16, 2018

ecrist commented May 16, 2018 via email

SundialServices commented Jul 26, 2018

ecrist commented Aug 23, 2018

rebbdohr commented Feb 21, 2017 •

edited

Loading

ilium007 commented Dec 24, 2017 •

edited

Loading

ilium007 commented Dec 24, 2017 •

edited

Loading

ilium007 commented Dec 24, 2017 •

edited

Loading

ilium007 commented Dec 24, 2017 •

edited

Loading