Dear maintainer,

I noticed a regression in easy-rsa 3.1.0 compared to easy-rsa 3.0.8
shipping in bullseye. The --req-cn option is ignored by easy-rsa 3.1.0
when the gen-req command is used.

Using the test script attached I get the following (and expected)
output on bullseye (easy-rsa 3.0.8):

Whereas on bookwork (easy-rsa 3.1.0) I get the following output:

(Notice the CN of the generated certificate, i.e. the last output line).

The correct behaviour of the --req-cn option was restored in upstream
version 3.1.1. Please consider updating easy-rsa to the latest version
for bookworm.

Thank you.

Kind regards,
Dennis

I attached a patch based on upstream commit
fe3cced16c62de5dd33f3a230ee03e904306a55b which fixes the behaviour of
--req-cn.

Dear Bastian,

I noticed that you applied the patch I suggested for #995156.

Is there any chance you could also apply the patch I posted in my last
message to address this bug?

Since I use the --req-cn option in our production PKI, it not working
would block us from upgrading to bookworm once it is released.

Thank you very much for your efforts in advance.
Kind regards,
Dennis

We believe that the bug you reported is fixed in the latest version of
easy-rsa, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1032270@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastian Germann <bage@debian.org> (supplier of updated easy-rsa package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 11 Apr 2023 13:03:18 +0200
Source: easy-rsa
Architecture: source
Version: 3.1.0-0.3
Distribution: unstable
Urgency: medium
Maintainer: Michele Orrù <michele.orru@ens.psl.eu>
Changed-By: Bastian Germann <bage@debian.org>
Closes: 1032270
Changes:
 easy-rsa (3.1.0-0.3) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Option --req-cn: Restore original behavior
     (upstream patch, Closes: #1032270).
Checksums-Sha1:
 414b290b001cde594bdad15cee6e8a719edcd348 1733 easy-rsa_3.1.0-0.3.dsc
 ea3d34004117d9437f7cba7b31024c6c974c8f83 99212 easy-rsa_3.1.0-0.3.debian.tar.xz
 ee4501e0cde203ee34b41f960dde792bd390ac30 5449 easy-rsa_3.1.0-0.3_source.buildinfo
Checksums-Sha256:
 a2f4e0a93d1dc7701f29e838c896ec35227f1d92351821cc53259e1d2208e40a 1733 easy-rsa_3.1.0-0.3.dsc
 a9ce439400644e9fffb55dac3adfd1c41287f063ff76cf848f86a0516f9372b0 99212 easy-rsa_3.1.0-0.3.debian.tar.xz
 22ecad6535efc40be54f475fffce1d309d8f037884cf112d9288a0919cd3c1ac 5449 easy-rsa_3.1.0-0.3_source.buildinfo
Files:
 9b4ab8848f22de998eeedd7769c6c4a4 1733 utils optional easy-rsa_3.1.0-0.3.dsc
 237bda76a54273f152ee58c3346dce04 99212 utils optional easy-rsa_3.1.0-0.3.debian.tar.xz
 349b55a76f7a780885f15c9043cd5a96 5449 utils optional easy-rsa_3.1.0-0.3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmQ1QFsQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFBqlC/4sCGq+6sViGiZZ2OW2h7hrd8gGr/oTD/bJ
RWIXGVm16P87cWJPNDZebBJNlwd5BADzCGTXz6LgGQE8qJsLihv3YZVu0XBsKJTc
zCruZ5ov1jA5UhkH+Ns0OYzu5HwPkSVMcPexfrKRkQMdBLyKcBQEQFi9QO4Y6Goj
gwyTBQTm5E6ZwgPueMoXF6Ue/aeM+BBNMwac+AqfOwc8woLs/2GdvEyhJ2NhoxsA
JopNLrfu4fdHV9xmJqdyGMvYEqRhyoRZA3X8fmSzCToIz28eDcfbXVYV3u2xUEIS
QN/z7IuI5MJdbH50a+2n5TRd7oSfETtTMIAPGFxaj5kjDhSpWn2pF9FaeRapoSNa
OSec467svRdbhVq8zyCGSSG9Y02sIzMBcRaFEpDjxhLDkWIMvjuf2EQoaOtjO6sN
GThYXsR0nrqQk3kFH+3yAjGnd4/oz6M1hH2tDoTpQLCmXdPxQd63UE+eYW5dZUil
/GKrciEBDpucjmYGKb/vhgvbLAONDFs=
=LJCL
-----END PGP SIGNATURE-----

Please check the autopkgtest that is now failing because it is waiting on entering "yes"
and consider handing in a patch for it.