EASY-RSA Version 2.0-rc1

This is a small RSA key management package, based on the openssl
command line tool, that can be found in the easy-rsa subdirectory
of the OpenVPN distribution.  While this tool is primary concerned
with key management for the SSL VPN application space, it can also
be used for building web certificates.

These are reference notes.  For step-by-step instructions, see the
HOWTO:

http://openvpn.net/howto.html

This package is based on the ./pkitool script.  Run ./pkitool
without arguments for a detailed help message (which is also pasted
below).

Release Notes for easy-rsa-2.0

* Most functionality has been consolidated into the pkitool
  script. For compatibility, all previous scripts from 1.0 such
  as build-key and build-key-server are provided as stubs
  which call pkitool to do the real work.

* pkitool has a --batch flag (enabled by default) which generates
  keys/certs without needing any interactive input.  pkitool
  can still generate certs/keys using interactive prompting by
  using the --interact flag.

* The inherit-inter script has been provided for creating
  a new PKI rooted on an intermediate certificate built within a
  higher-level PKI.  See comments in the inherit-inter script
  for more info.

* The openssl.cnf file has been modified.  pkitool will not
  work with the openssl.cnf file included with previous
  easy-rsa releases.

* The vars file has been modified -- the following extra
  variables have been added: EASY_RSA, CA_EXPIRE,
  KEY_EXPIRE.

* The make-crl and revoke-crt scripts have been removed and
  are replaced by the revoke-full script.

* The "Organizational Unit" X509 field can be set using
  the KEY_OU environmental variable before calling pkitool.

* This release only affects the Linux/Unix version of easy-rsa.
  The Windows version (written to use the Windows shell) is unchanged.

* Use the revoke-full script to revoke a certificate, and generate
  (or update) the crl.pem file in the keys directory (as set by the
  vars script).  Then use "crl-verify crl.pem" in your OpenVPN server
  config file, so that OpenVPN can reject any connections coming from
  clients which present a revoked certificate.  Usage for the script is:

    revoke-full <common-name>

  Note this this procedure is primarily designed to revoke client
  certificates. You could theoretically use this method to revoke
  server certificates as well, but then you would need to propagate
  the crl.pem file to all clients as well, and have them include
  "crl-verify crl.pem" in their configuration files.

* PKCS#11 support was added.

* For those interested in using this tool to generate web certificates,
  A variant of the easy-rsa package that allows the creation of multi-domain
  certificates with subjectAltName can be obtained from here:

  http://www.bisente.com/proyectos/easy-rsa-subjectaltname/

INSTALL easy-rsa

1. Edit vars.
2. Set KEY_CONFIG to point to the openssl.cnf file
   included in this distribution.
3. Set KEY_DIR to point to a directory which will
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                