Skip to content

OpenBSD/LibreSSL failure #1390

Closed
Bug
#1394
Closed
OpenBSD/LibreSSL failure#1390
Bug
#1394
Assignees
TinCanTech
Labels
BUGLibreSSLVersion 3.2.4-Release
Milestone
v3.2.5

Description

@crickc
crickc
opened on Sep 16, 2025

I'm creating a new PKI on OpenBSD 7.7 using the latest release of easy-rsa. After issuing some certs, generating the CRL fail.

./easyrsa --version                                                                                                       
EasyRSA Version Information
Version:     3.2.4
Generated:   Wed Aug 27 07:28:22 CDT 2025
SSL Lib:     LibreSSL 4.1.0
Git Commit:  84be9c631c1efb872ff8cc9f16b9af4e7f018af3
Source Repo: https://github.com/OpenVPN/easy-rsa

./easyrsa gen-crl                                                                                                         
Using Easy-RSA 'vars' configuration:
* /srv/vpn/pki/vars
129817013464:error:0EFFF068:configuration file routines:CRYPTO_internal:variable has no value:/usr/src/lib/libcrypto/conf/conf_def.c:506:line 10

Easy-RSA error:

easyrsa_openssl - Command has failed:
* openssl ca -utf8 -gencrl -out /srv/vpn/pki/fb39265d/temp.02 -crldays 365

EasyRSA Version Information
Version:     3.2.4
Generated:   Wed Aug 27 07:28:22 CDT 2025
SSL Lib:     undefined
Git Commit:  84be9c631c1efb872ff8cc9f16b9af4e7f018af3
Source Repo: https://github.com/OpenVPN/easy-rsa
Host: 3.2.4 | nix | OpenBSD | /bin/ksh

Easy-rsa-3.1.1 (patched for LibreSSL 4) on OpenBSD 7.7 is working correctly.
On OpenBSD mailing list, someone reported that easyrsa gen-dh is giving the same error.

Activity

  1. TinCanTech commented on Sep 16, 2025

    @TinCanTech
    TinCanTech
    on Sep 16, 2025
    Collaborator

    Easy-rsa-3.1.1 (patched for LibreSSL 4) on OpenBSD 7.7 is working correctly.

    Can you point me to the patch(s) in question ?

  2. TinCanTech commented on Sep 16, 2025

    @TinCanTech
    TinCanTech
    on Sep 16, 2025
    Collaborator

    @crickc if you give me access to an OpenBSD system then I will try to debug this for you.

  3. crickc commented on Sep 16, 2025

    @crickc
    crickc
    on Sep 16, 2025
    Author

    Easy-rsa-3.1.1 was patched manually using your patch:
    7df616b

    For the OpenBSD system, i will look into providing you one but it will take some time.

  4. TinCanTech commented on Sep 16, 2025

    @TinCanTech
    TinCanTech
    on Sep 16, 2025
    Collaborator

    LibreSSL works perfectly in all my local tests.

  5. TinCanTech
    added
    LibreSSL
    on Sep 16, 2025
  6. TinCanTech
    self-assigned this
    on Sep 16, 2025

  7. TinCanTech commented on Sep 17, 2025

    @TinCanTech
    TinCanTech
    on Sep 17, 2025
    Collaborator

    @crickc FYI:

    tct@wiscii:~/git/easy-rsa/test/installed/test D$ EASYRSA_OPENSSL=/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl easyrsa --verbose --batch --nopass init-pki
  # init-pki: verify_working_env; default_vars; defaults set OK
  # init-pki: verify_working_env; mutual_exclusions; COMPLETED
  # init-pki: verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl)
  # init-pki: verify_working_env; secure_session; CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/4c5f786e
  # init-pki: verify_working_env; easyrsa_mktemp; test_temp_file /home/tct/git/easy-rsa/test/installed/test D/pki/4c5f786e/temp.00
  # init-pki: verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/4c5f786e/temp.01
  # init-pki: verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # init-pki: verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/4c5f786e/temp.01
  # init-pki: verify_working_env; locate_support_files; EASYRSA_EXT_DIR: built-in
  # init-pki: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: built-in
  # init-pki; BEGIN: algo: 'rsa' | curve: ''
  # init-pki; TRY: algo: 'rsa' | curve: ''
  # init-pki; verify_algo_params; OK: algo 'rsa' | curve ''
  # init-pki; write_legacy_file_v2; over-write IGNORED for vars

Notice
------
'init-pki' complete; you may now create a CA or requests.

Your newly created PKI dir is:
* /home/tct/git/easy-rsa/test/installed/test D/pki

  # init-pki; select_vars; No vars
  # init-pki; cleanup: lock-file does not exist.
  # init-pki; Exit: Final Success = true
tct@wiscii:~/git/easy-rsa/test/installed/test D$ EASYRSA_OPENSSL=/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl easyrsa --verbose --batch --nopass build-ca
  # build-ca: verify_working_env; select_vars; No vars
  # build-ca: verify_working_env; default_vars; defaults set OK
  # build-ca: verify_working_env; mutual_exclusions; COMPLETED
  # build-ca: verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl)
  # build-ca: verify_working_env; request_lock_file; lock-file CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/lock.file
  # build-ca: verify_working_env; secure_session; CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0
  # build-ca: verify_working_env; easyrsa_mktemp; test_temp_file /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.00
  # build-ca: verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.01
  # build-ca: verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # build-ca: verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.01
  # build-ca: verify_working_env; verify_algo_params; OK: algo 'rsa' | curve ''
  # build-ca: verify_working_env; locate_support_files; EASYRSA_EXT_DIR: built-in
  # build-ca: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: built-in
  # build-ca; easyrsa_mktemp; ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.02
  # build-ca; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # build-ca; write_easyrsa_ssl_cnf_tmp; safe-cnf - EASYRSA_SSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.02
  # build-ca; write_easyrsa_ssl_cnf_tmp; LOCAL - OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.02
  # build-ca; easyrsa_mktemp; out_key_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.03
  # build-ca; easyrsa_mktemp; out_file_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.04
  # build-ca; easyrsa_mktemp; write_x509_file_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.05
  # build-ca; write_legacy_file_v2; over-write ENABLED for ca
  # build-ca; write_x509_type_tmp; 'ca' COMPLETE
  # build-ca; easyrsa_mktemp; write_x509_file_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.06
  # build-ca; write_legacy_file_v2; over-write ENABLED for COMMON
  # build-ca; write_x509_type_tmp; 'COMMON' COMPLETE
  # build-ca; easyrsa_mktemp; adjusted_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.07
  # build-ca; Insert x509 and extensions OK
  # build-ca; easyrsa_openssl; BEGIN genpkey
  # build-ca; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.07
...................................................................................................
..................................................................
  # build-ca; easyrsa_openssl; END genpkey
  # build-ca; CA key has no password
  # build-ca; easyrsa_openssl; BEGIN req
  # build-ca; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.07
  # build-ca; easyrsa_openssl; END req

Notice
------
CA creation complete. Your new CA certificate is at:
* /home/tct/git/easy-rsa/test/installed/test D/pki/ca.crt

Build-ca completed successfully.

  # build-ca; remove_secure_session; DELETED /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0
  # build-ca; mktemp_counter: 8 uses
  # build-ca; cleanup: lock-file REMOVED OK
  # build-ca; Exit: Final Success = true
tct@wiscii:~/git/easy-rsa/test/installed/test D$ EASYRSA_OPENSSL=/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl easyrsa --verbose --batch --nopass gen-dh
  # gen-dh: verify_working_env; select_vars; No vars
  # gen-dh: verify_working_env; default_vars; defaults set OK
  # gen-dh: verify_working_env; mutual_exclusions; COMPLETED
  # gen-dh: verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl)
  # gen-dh: verify_working_env; request_lock_file; lock-file CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/lock.file
  # gen-dh: verify_working_env; secure_session; CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1
  # gen-dh: verify_working_env; easyrsa_mktemp; test_temp_file /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.00
  # gen-dh: verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.01
  # gen-dh: verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # gen-dh: verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.01
  # gen-dh: verify_working_env; verify_algo_params; OK: algo 'rsa' | curve ''
  # gen-dh: verify_working_env; locate_support_files; EASYRSA_EXT_DIR: built-in
  # gen-dh: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: built-in
  # gen-dh; easyrsa_mktemp; tmp_dh_file /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.02
  # gen-dh; easyrsa_openssl; BEGIN dhparam
  # gen-dh; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.01
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................*
  # gen-dh; easyrsa_openssl; END dhparam
  # gen-dh; easyrsa_openssl; BEGIN dhparam
  # gen-dh; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.01
DH parameters appear to be ok.
  # gen-dh; easyrsa_openssl; END dhparam

Notice
------

DH parameters of size 2048 created at:
* /home/tct/git/easy-rsa/test/installed/test D/pki/dh.pem

  # gen-dh; remove_secure_session; DELETED /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1
  # gen-dh; mktemp_counter: 3 uses
  # gen-dh; cleanup: lock-file REMOVED OK
  # gen-dh; Exit: Final Success = true
tct@wiscii:~/git/easy-rsa/test/installed/test D$ EASYRSA_OPENSSL=/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl easyrsa --verbose --batch --nopass gen-crl
  # gen-crl: verify_working_env; select_vars; No vars
  # gen-crl: verify_working_env; default_vars; defaults set OK
  # gen-crl: verify_working_env; mutual_exclusions; COMPLETED
  # gen-crl: verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl)
  # gen-crl: verify_working_env; request_lock_file; lock-file CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/lock.file
  # gen-crl: verify_working_env; secure_session; CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293
  # gen-crl: verify_working_env; easyrsa_mktemp; test_temp_file /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.00
  # gen-crl: verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.01
  # gen-crl: verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # gen-crl: verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.01
  # gen-crl: verify_working_env; verify_algo_params; OK: algo 'rsa' | curve ''
  # gen-crl: verify_working_env; locate_support_files; EASYRSA_EXT_DIR: built-in
  # gen-crl: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: built-in
  # gen-crl; easyrsa_mktemp; out_file_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.02
  # gen-crl; easyrsa_openssl; BEGIN ca
  # gen-crl; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.01
Using configuration from /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.01
  # gen-crl; easyrsa_openssl; END ca

Notice
------
An updated CRL DER copy has been created:
* /home/tct/git/easy-rsa/test/installed/test D/pki/crl.der

An updated CRL has been created:
* /home/tct/git/easy-rsa/test/installed/test D/pki/crl.pem

IMPORTANT: When the CRL expires, an OpenVPN Server which uses a
CRL will reject ALL new connections, until the CRL is replaced.

  # gen-crl; remove_secure_session; DELETED /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293
  # gen-crl; mktemp_counter: 3 uses
  # gen-crl; cleanup: lock-file REMOVED OK
  # gen-crl; Exit: Final Success = true
tct@wiscii:~/git/easy-rsa/test/installed/test D$

    I guess your high security system is fallable.

  8. TinCanTech
    added
    feedback welcome
    on Sep 17, 2025

  9. TinCanTech commented on Sep 17, 2025

    @TinCanTech
    TinCanTech
    on Sep 17, 2025
    Collaborator

    My guess, which is something that you should know, is that your seclevel forbids RSA keys with only 2048 bits. Please consult your OS documentation.

  10. crickc commented on Sep 17, 2025

    @crickc
    crickc
    on Sep 17, 2025
    Author

    Easy-rsa release still include the file openssl-easyrsa.cnf and it is used by default.

    # gen-crl: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: /srv/vpn_new_bug/openssl-easyrsa.cnf

    There must be a missing variable in openssl-easyrsa.cnf because forcing EASYRSA_SSL_CONF to the built-in value work for me ...

  11. TinCanTech commented on Sep 17, 2025

    @TinCanTech
    TinCanTech
    on Sep 17, 2025
    Collaborator

    From your original post:

    EasyRSA Version Information
    Version: 3.2.4
    Generated: Wed Aug 27 07:28:22 CDT 2025
    SSL Lib: undefined

    If the SSL lib is undefined then easyrsa will assume OpenSSL.

    With your original openssl-easyrsa.cnf, you can try option --force-safe-ssl.
    Which will force the expansion of your current SSL config.

    Also, I am trying to build an OpenBSD VM, to test with.

  12. TinCanTech commented on Sep 17, 2025

    @TinCanTech
    TinCanTech
    on Sep 17, 2025
    Collaborator

    @crickc Can you please post the output of easyrsa --verbose.

  13. crickc commented on Sep 17, 2025

    @crickc
    crickc
    on Sep 17, 2025
    Author

    The openssl-easyrsa.cnf (/srv/vpn_new_bug/openssl-easyrsa.cnf) is the file included in easy-rsa release package (without modification).
    Just run your previous test ( #1390 (comment) ) with EASYRSA_SSL_CONF pointing to openssl-easyrsa.cnf (instead of using the built-in value) and you should get my error.

  14. crickc commented on Sep 17, 2025

    @crickc
    crickc
    on Sep 17, 2025
    Author

    As requested:

    ./easyrsa --verbose                                
  # : verify_working_env; select_vars; selected /srv/vpn_new_bug/vars
Using Easy-RSA 'vars' configuration:
* /srv/vpn_new_bug/vars
  # : verify_working_env; source_vars; sourced /srv/vpn_new_bug/vars
  # : verify_working_env; mutual_exclusions; COMPLETED
  # : verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (openssl)
  # : verify_working_env; secure_session; CREATED /srv/vpn_new_bug/pki/cf5e7a06
  # : verify_working_env; easyrsa_mktemp; test_temp_file /srv/vpn_new_bug/pki/cf5e7a06/temp.00
  # : verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /srv/vpn_new_bug/pki/cf5e7a06/temp.01
  # : verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # : verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /srv/vpn_new_bug/pki/cf5e7a06/temp.01
  # : verify_working_env; locate_support_files; EASYRSA_EXT_DIR: /srv/vpn_new_bug/x509-types
  # : verify_working_env; locate_support_files; EASYRSA_SSL_CONF: /srv/vpn_new_bug/openssl-easyrsa.cnf

Easy-RSA 3 Overview:

To get a list of available options and commands, use:
  ./easyrsa help

To get detailed usage and help for commands, use:
  ./easyrsa help <COMMAND>

DIRECTORY STATUS (commands would take effect on these locations)
     EASYRSA: /srv/vpn_new_bug
         PKI: /srv/vpn_new_bug/pki
   vars-file: /srv/vpn_new_bug/vars
   Algorithm: ed
       Curve: ed25519
   CA status: OK

    subject= 
    commonName                = Easy-RSA CA

  # ; ssl-cnf: /srv/vpn_new_bug/openssl-easyrsa.cnf
  # ; x509-types: /srv/vpn_new_bug/x509-types
  # ; temp-dir: Found: /srv/vpn_new_bug/pki
  # ; remove_secure_session; DELETED /srv/vpn_new_bug/pki/cf5e7a06
  # ; mktemp_counter: 2 uses
  # ; cleanup: lock-file does not exist.
  # ; Exit: Final Success = true

  15. TinCanTech commented on Sep 17, 2025

    @TinCanTech
    TinCanTech
    on Sep 17, 2025
    Collaborator

    I have reproduced this error for both gen-crl and gen-dh, now the rabbit-hole looms!

    @crickc thanks for reporting this and your help.

  16. 2 remaining items

  17. TinCanTech commented on Sep 17, 2025

    @TinCanTech
    TinCanTech
    on Sep 17, 2025
    Collaborator

    Problem identified and resolved, patch imminent.

    A logic error in easyrsa safe-ssl generation for LibreSSL, which seems to indicate that LibreSSL built for Linux allows for variable expansion in the config file.

  18. TinCanTech commented on Sep 20, 2025

    @TinCanTech
    TinCanTech
    on Sep 20, 2025
    Collaborator

    I have posted a definitive PR #1392, to record to root issue.

    Short version:

    • verify_ssl_lib(): ssl_cnf_type=safe-cnf does not get the job of expanding the SSL config done.
    • Using $EASYRSA_FORCE_SAFE_SSL correctly, does work.

    I have a hat and a rabbit .. need magic wand ;-)

  19. TinCanTech
    linked a pull request that will close this issueRemove: write_global_safe_ssl_cnf_tmp() #1393on Sep 21, 2025
  20. TinCanTech
    linked a pull request that will close this issueReplace `local` / `global` `openssl-easyrsa.cnf` #1394on Sep 27, 2025

  21. TinCanTech commented on Oct 2, 2025

    @TinCanTech
    TinCanTech
    on Oct 2, 2025
    Collaborator

    I intend to merge #1394

    @crickc would you like a mention in the ChangeLog ?

  22. crickc commented on Oct 2, 2025

    @crickc
    crickc
    on Oct 2, 2025
    Author

    No, thank you !

  23. TinCanTech
    added
    Version 3.2.4-Release
    and removed
    feedback welcome
    on Oct 3, 2025
  24. TinCanTech
    added this to the v3.2.5 milestone on Oct 3, 2025
  25. TinCanTech
    closed this as completedin #1394on Oct 3, 2025

  26. TinCanTech commented on Oct 3, 2025

    @TinCanTech
    TinCanTech
    on Oct 3, 2025
    Collaborator

    This should fix all the issues reported on the OpenBSD misc mailing list. If not then please open a new issue here.

  27. TinCanTech
    pinned this issue on Oct 29, 2025
  28. TinCanTech
    unpinned this issue on Feb 12, 2026
  29. TinCanTech
    pinned this issue on Feb 17, 2026
  30. TinCanTech
    unpinned this issue on Feb 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BUGLibreSSLVersion 3.2.4-Release

Type

Bug

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions