1

I have been using easyrsa to generate client certificates for my application using the method described here.

The build-client-full command generates a fresh private key for each client. This is what I currently use... run build-client-full send the private key, certificate and ca cert to the client.

What I want to do is have the client generate their own private key locally, send me their public key, and I make the certificate and send it to the client where me as the CA decides the properties of the cert (Common name specifically).

How do I go about it? If I have the client generate CSR, how do I edit the properties in easyrsa before signing? Is easyrsa too simple for this and I need something more complex?

Improve this question

1 Answer 1

Reset to default
1

You can use import-req command to import client csr and then sign it. For more info check the documentation of easy-rsa program

Improve this answer
4
  • Yes, but how would I edit the csr before(or after) doing import-req?
    – Sajal Kayan
    Jun 1, 2015 at 19:22
  • If the request is done by rules you do not need to edit it by hand. If users want to create request by self should follow the rules
    – Romeo Ninov
    Jun 1, 2015 at 19:26
  • Screw the rules. I want to decide what goes into the cert. Only thing I want from the user is public key. I dont want to tell the user "hey make csr with these paramaters and send it to me". I want to tell them "send me your public key and I give you cert to use".
    – Sajal Kayan
    Jun 1, 2015 at 22:12
  • In such case you can create web form where they will fill and enter info and you will set the rest of the info
    – Romeo Ninov
    Jun 2, 2015 at 20:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .