**Problem 1**: Users following the EasyRSA script in the docs with their
more recent distro version of EasyRSA find that the generated certs no
longer include a subject-alternative-name (SAN), which is required as of
Go 1.15 / zrepl 0.3.0.
**Problem 2**: Newer openssl versions with the old EasyRSA prompt the
user for a CA password in `init-pki` and depending on EasyRSA version
there are other interactive prompts at later commands in the script.
**Changes**:
- upgrade the pinned EasyRSA version to the latest release
- use `--auto-san` option to make EasyRSA set the SAN. This has the
benefit of also working for IP addresses.
I checked the easy-rsa git history and `--subject-alt-name` appears to
have been present in all 3.X releases, so, adding the flag shouldn't
break users of older EasyRSA 3.X.
(And these are exemplary instructions anyway.)
refs
- fixes https://github.com/zrepl/zrepl/issues/900
- obsoletes https://github.com/zrepl/zrepl/pull/906
- obsoletes https://github.com/zrepl/zrepl/pull/877
Co-authored-by: Andrew Lorimer <andrew@lorimer.id.au>
Christian Schwarz
e524b60f24