#1137580 /usr/share/easy-rsa/easyrsa: build-client-full and build-serverClient-full only include TLS server extension

Package:
easy-rsa
Source:
easy-rsa
Submitter:
Jaap Keuter
Date:
2026-05-25 09:33:02 UTC
Severity:
normal
#1137580#5
Date:
2026-05-25 09:31:38 UTC
From:
To:
Dear Maintainer,

Using the easyrsa commands `build-client-full` or `build-serverClient-full`
generate certificates with the `extendedKeyUsage=serverAuth` extension.
With `build-client-full` the extension should be `extendedKeyUsage=clientAuth`,
while `build-serverClient-full` should have both.

The cause comes down to one omission in the script:

diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index c5ba1bb..bb3ec51 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -3022,7 +3022,7 @@ $(cat "$crt_source")
                crt_fingerprint="${crt_fingerprint#*=}"

                # Certificate type
-               inline_crt_type=
+               inline_crt_type="$crt_type"
                ssl_cert_x509v3_eku "$crt_source" inline_crt_type || \
                        warn "inline_file: Unknown cert-type:
'$inline_crt_type'"