Easy-RSA - x509-type CA, basicConstraint = critical, proposal

--b1=_3aCKGvisROVT3TwBznuJXNe0HPfAjexQ6bQBzujew
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


Hi,

Easy-RSA is intending to change the default CA X509-type by including
the 'basicConstraint =3D critical' bit.

New CAs and subCAs will include the following attribute:

        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
=20
 This is due to python requirement VERIFY_X509_STRICT.
=20
 While Easy-RSA already provides the option --bc-crit, which adds the
 'critical' bit to any new certificate, the folk from python are asking
 that this become the absolute default for Easy-RSA CA/subCA certificates.
=20
 No objections have been raised so far but we decided to ask, before the
 hammer falls, if there are any demonstrable reasons to oppose this change?
=20
 Thanks for your feedback.
=20
 Richard
=20


Sent with Proton Mail secure email.


-----BEGIN PGP SIGNATURE-----
Version: ProtonMail

wsC5BAEBCgBtBYJpl+1eCRBPl5z2a5C4nUUUAAAAAAAcACBzYWx0QG5vdGF0
aW9ucy5vcGVucGdwanMub3JnV21om81xxRdYHyc9l6aNURKKS1gscL2hAll8
yss3BbgWIQQJvD1EZ6ONcnnFVVVPl5z2a5C4nQAAK+4H/RifVq2nz2JhCqzL
wkztPagxeQfZqOoh4xFPS99nVjHpQKPpxsA4bWLMjy6v+XCN2Chqohv2ij72
mpwXTNiLCKYPp7cFFyXBYzDKuFwV8j3YTkpJLigq91XP1UsZHaqSxu9lmYyN
sQWcRbaLoTfXWKGW99O0jpS6F3k/ec/RqjbBdF6RHhvODuB5/6Nzs3R3ZE0Q
RNWonFVM1cz6bb/gmT0mPbIggCZgEPG2LTWgk3dpnrZyLyeRWK9FGHY5Lzoa
FlGErnRgVLXgbtpoG9wvWkQ8JA1oLGtzVDp3TPRSjcXzqGmOmcnWWpzFMePe
qJAym4YUWBCv5ZYiIlw80RolL98=3D
=3DGBkB
-----END PGP SIGNATURE-----

--b1=_3aCKGvisROVT3TwBznuJXNe0HPfAjexQ6bQBzujew
Content-Type: application/pgp-keys; name="publickey - [email protected] - 0x09BC3D44.asc"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="publickey - [email protected] - 0x09BC3D44.asc"

LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgp4c0JOQkZ2d1NjY0JDQURPbUhF
blFsTG1PakpSdEpMMmw1M01Md3dGVHk3WG5FcHMzYjFRMFV3V1lGQ3YKTDJvTnAwbnJkR2xLS0RK
cTUwWTA5U1IrVVJZQlFtS21ZM0VtenB5VUlLTS9yZ28xUnl1YkhwTVJIYkRwCjdKcDhMeGtmZkZC
VkpqL3Q1Vk1wRDZlTVI2YVVjaVFqZ1JMOE5aZTYrVDd4ZlhYWHdWNWhvUmVaM2pPKwp6SGk2U1I3
eFR2R1hsYStNUXo2RUVwV25sYkx2ZzJvcnQ5S3NldVZqWXJxdlJNeGNkUDBvOWNaV0o1ZXAKSk5t
Z2VCNk03K09XMDhVMVNzWHRLcnBMUmNJNnlLbVYzOGpoelByMlpnUDlybXJsRXJSLzFpcVFRSFhZ
Cm84LzBEZlB5RjBtSDl5blFJaUxFL2wrRll1NHJzRzhWaUtseGhYY3plUHpBdExDamlCMGEwbVJW
QUJFQgpBQUhOTnlKMGFXNWpZVzUwWldOb1FIQnliM1J2Ym0xaGFXd3VZMjl0SWlBOGRHbHVZMkZ1
ZEdWamFFQncKY205MGIyNXRZV2xzTG1OdmJUN0N3SDhFRUFFSUFDa0ZBbHZ3U2NjR0N3a0hDQU1D
Q1JCUGw1ejJhNUM0Cm5RUVZDQW9DQXhZQ0FRSVpBUUliQXdJZUFRQUtDUkJQbDV6MmE1QzRuUUJE
Qi85WlVvOUJPWEpSNjFObQowMm9aLzhhUlhPOU5uVVNGdDZHTE9XY0ROdkFzNElKV01EVkVRZllh
bmIrNDIxUU5kLzVkNkgxaVhGK2kKNExESzBNNmFnQytnc05GSm5qUEdJdHZQdGo3V3lqeW5aUng4
RDQwUFBYaWdmSFl1dzJvUnUwbHIrUDFwCjFxZVVlNE5iY3FJdjhJSXZMejJ6Q2xZWk9OZ0FzUVZj
TkFIaTdaNG9ydFEyaW8yQkFWai84MTlKUFlNdAp0SGdZODF3UzFWN3Y4R0RUWmc4b2FQaFhHZmFD
NFRaRkd0WnIvYnliY3Fyc28zNWphUW1DNTR4TWJYcEYKQVVyYzN1R1ZPSCtPZEcvQlcyZ2NZcXB2
VUZCdWtYeENVQllIUDJOZlhoTmZ6R3Q5bkMxdWxOS1llUDE5ClRHbE9vckJNWUlBRUhvR3h2cGJV
WGZiYU5XQ1V6c0JOQkZ2d1NjY0JDQUM5S3lWWlJTNWFNYUc1UGkwbgpmeDhhTm9zM2JZcDI0Nk10
ZmFvS0JmVFFBcmQrR1pXK1duRnlKRWlTeUxkejByVXV0eUNBZGY1bGdWSCsKV3ZMdkltaUdyU3J6
VnBNVDJuQ1MwOUxxTDUwUWp6OEE3Z3A1SC9oUXp0WjhpTnlzR0Q5Tk80Nk9uSTc1CjkwZEhmQ3JY
alFQU0Z0RkdzVHpnRHhRSWlNdXp6OURSN0Jla0tQbXVPRkloQmU5ZUVacWJ4YzhSV2VRdApoYTdp
L0RySlRSTksxYU9BRFFGVnVWMS9BbTVUaEdQV0ZNL1lKVXlUWWhNVzB5ZVBoNDVPYld1UlFaa3MK
bCthT200TDBLR0REWWxtL0ZReC9FTUN1YnZsenkvenhEZEI2bnFGaWgycVpyZnltbmlTT0thakcw
am9UCnBab3ovRXorNGZBdGc2eTBQc3BOUjZpZEFCRUJBQUhDd0drRUdBRUlBQk1GQWx2d1NjY0pF
RStYblBacgprTGlkQWhzTUFBb0pFRStYblBacmtMaWRSZTBIL2o1Q0lGSUF1Y3VhaUVNa0xrTktF
QU81czd4NDdlTnkKR1BmWnNseVkrSGp6R1UwZDA3TWtrR21Wa1BUVnp3cVZ6Tlpibnk3WkF2MXps
VzBVeTB5SHAxQVBweVl0CjhidVVwcFRCcTdkNDdvZ3hFUll6dC9MYzJMNWEvVktGTlJiaE4xL1hR
bVBpejJFbGU0dHlpcGJUYXBjeQoremJ5ZnpBTUQxM2NJZFoxM2hUc05QMG9sZ0JoQXFVQVVVWXB4
UmxrQUhlSitEdDNOYnpIUzRLUUs1MzgKTkovbDdiWFNLc0dxb1lxSmVaOFZOQnh3V1dVYnVHNGpq
cmg0M01JUmdVWjVXc1BVWVY2SHgwNTZrTWpiCi9iWUJqSTBURU12SDgxNjB1cXpGWGVIdll5VWxx
MFNpbkQvWjlpb0llOFFkc0hHQkRVSVJZWXViMXBPOApxckN6Ulp4MG9OQT0KPS9EZWEKLS0tLS1F
TkQgUEdQIFBVQkxJQyBLRVkgQkxPQ0stLS0tLQo=

--b1=_3aCKGvisROVT3TwBznuJXNe0HPfAjexQ6bQBzujew
Content-Type: application/pgp-signature; name="publickey - [email protected] - 0x09BC3D44.asc.sig"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="publickey - [email protected] - 0x09BC3D44.asc.sig"

wsC5BAABCgBtBYJpl+1eCRBPl5z2a5C4nUUUAAAAAAAcACBzYWx0QG5vdGF0aW9ucy5vcGVucGdw
anMub3JnqGb/f3jJ0Xop6PZY1iKq6r6kmXXq16vLvV9WFFzPPqkWIQQJvD1EZ6ONcnnFVVVPl5z2
a5C4nQAAlBYIAKBBafPvmXuzHSKpnsPpyPhVEJlGXF8X6Y0sPvRHErWTn4glFrsmhUhe1DazMFxP
wmkd52h52h4Z7e5JltFSf8W7akZgTluKXcA8B7BfOTncRT29nF3EO+nkSS2mPVwC4ZW4F5IrCIUc
ai3MKF4VhFwC8cl9t2T2R57jTH4kBbI8929A7wajC7pBWNEVRe5zAb1SnqBMM+9Zr3iSYAJZqZhI
aTtNtdKLh9JoTfZFEQH6R5Lri0P9koJ9E55+3VRFN6NuuWqYDQzWQHvACbc6WGMFavzuIXNXtJpd
t0XVwcj1RQrrWPNdFqwS0WV51/naHM+o9BU9MzfCiiSpOkVp6Lo=

--b1=_3aCKGvisROVT3TwBznuJXNe0HPfAjexQ6bQBzujew
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--b1=_3aCKGvisROVT3TwBznuJXNe0HPfAjexQ6bQBzujew
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users

--b1=_3aCKGvisROVT3TwBznuJXNe0HPfAjexQ6bQBzujew--