OpenBSD/LibreSSL failure

[crickc]

I'm creating a new PKI on OpenBSD 7.7 using the latest release of easy-rsa. After issuing some certs, generating the CRL fail.

./easyrsa --version                                                                                                       
EasyRSA Version Information
Version:     3.2.4
Generated:   Wed Aug 27 07:28:22 CDT 2025
SSL Lib:     LibreSSL 4.1.0
Git Commit:  84be9c631c1efb872ff8cc9f16b9af4e7f018af3
Source Repo: https://github.com/OpenVPN/easy-rsa

./easyrsa gen-crl                                                                                                         
Using Easy-RSA 'vars' configuration:
* /srv/vpn/pki/vars
129817013464:error:0EFFF068:configuration file routines:CRYPTO_internal:variable has no value:/usr/src/lib/libcrypto/conf/conf_def.c:506:line 10

Easy-RSA error:

easyrsa_openssl - Command has failed:
* openssl ca -utf8 -gencrl -out /srv/vpn/pki/fb39265d/temp.02 -crldays 365

EasyRSA Version Information
Version:     3.2.4
Generated:   Wed Aug 27 07:28:22 CDT 2025
SSL Lib:     undefined
Git Commit:  84be9c631c1efb872ff8cc9f16b9af4e7f018af3
Source Repo: https://github.com/OpenVPN/easy-rsa
Host: 3.2.4 | nix | OpenBSD | /bin/ksh

Easy-rsa-3.1.1 (patched for LibreSSL 4) on OpenBSD 7.7 is working correctly.
On OpenBSD mailing list, someone reported that easyrsa gen-dh is giving the same error.

[TinCanTech]

Easy-rsa-3.1.1 (patched for LibreSSL 4) on OpenBSD 7.7 is working correctly.

Can you point me to the patch(s) in question ?

[TinCanTech]

@crickc if you give me access to an OpenBSD system then I will try to debug this for you.

[crickc]

Easy-rsa-3.1.1 was patched manually using your patch:
7df616b

For the OpenBSD system, i will look into providing you one but it will take some time.

[TinCanTech]

LibreSSL works perfectly in all my local tests.

[TinCanTech]

@crickc FYI:

tct@wiscii:~/git/easy-rsa/test/installed/test D$ EASYRSA_OPENSSL=/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl easyrsa --verbose --batch --nopass init-pki
  # init-pki: verify_working_env; default_vars; defaults set OK
  # init-pki: verify_working_env; mutual_exclusions; COMPLETED
  # init-pki: verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl)
  # init-pki: verify_working_env; secure_session; CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/4c5f786e
  # init-pki: verify_working_env; easyrsa_mktemp; test_temp_file /home/tct/git/easy-rsa/test/installed/test D/pki/4c5f786e/temp.00
  # init-pki: verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/4c5f786e/temp.01
  # init-pki: verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # init-pki: verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/4c5f786e/temp.01
  # init-pki: verify_working_env; locate_support_files; EASYRSA_EXT_DIR: built-in
  # init-pki: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: built-in
  # init-pki; BEGIN: algo: 'rsa' | curve: ''
  # init-pki; TRY: algo: 'rsa' | curve: ''
  # init-pki; verify_algo_params; OK: algo 'rsa' | curve ''
  # init-pki; write_legacy_file_v2; over-write IGNORED for vars

Notice
------
'init-pki' complete; you may now create a CA or requests.

Your newly created PKI dir is:
* /home/tct/git/easy-rsa/test/installed/test D/pki

  # init-pki; select_vars; No vars
  # init-pki; cleanup: lock-file does not exist.
  # init-pki; Exit: Final Success = true
tct@wiscii:~/git/easy-rsa/test/installed/test D$ EASYRSA_OPENSSL=/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl easyrsa --verbose --batch --nopass build-ca
  # build-ca: verify_working_env; select_vars; No vars
  # build-ca: verify_working_env; default_vars; defaults set OK
  # build-ca: verify_working_env; mutual_exclusions; COMPLETED
  # build-ca: verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl)
  # build-ca: verify_working_env; request_lock_file; lock-file CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/lock.file
  # build-ca: verify_working_env; secure_session; CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0
  # build-ca: verify_working_env; easyrsa_mktemp; test_temp_file /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.00
  # build-ca: verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.01
  # build-ca: verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # build-ca: verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.01
  # build-ca: verify_working_env; verify_algo_params; OK: algo 'rsa' | curve ''
  # build-ca: verify_working_env; locate_support_files; EASYRSA_EXT_DIR: built-in
  # build-ca: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: built-in
  # build-ca; easyrsa_mktemp; ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.02
  # build-ca; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # build-ca; write_easyrsa_ssl_cnf_tmp; safe-cnf - EASYRSA_SSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.02
  # build-ca; write_easyrsa_ssl_cnf_tmp; LOCAL - OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.02
  # build-ca; easyrsa_mktemp; out_key_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.03
  # build-ca; easyrsa_mktemp; out_file_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.04
  # build-ca; easyrsa_mktemp; write_x509_file_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.05
  # build-ca; write_legacy_file_v2; over-write ENABLED for ca
  # build-ca; write_x509_type_tmp; 'ca' COMPLETE
  # build-ca; easyrsa_mktemp; write_x509_file_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.06
  # build-ca; write_legacy_file_v2; over-write ENABLED for COMMON
  # build-ca; write_x509_type_tmp; 'COMMON' COMPLETE
  # build-ca; easyrsa_mktemp; adjusted_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.07
  # build-ca; Insert x509 and extensions OK
  # build-ca; easyrsa_openssl; BEGIN genpkey
  # build-ca; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.07
...................................................................................................
..................................................................
  # build-ca; easyrsa_openssl; END genpkey
  # build-ca; CA key has no password
  # build-ca; easyrsa_openssl; BEGIN req
  # build-ca; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0/temp.07
  # build-ca; easyrsa_openssl; END req

Notice
------
CA creation complete. Your new CA certificate is at:
* /home/tct/git/easy-rsa/test/installed/test D/pki/ca.crt

Build-ca completed successfully.

  # build-ca; remove_secure_session; DELETED /home/tct/git/easy-rsa/test/installed/test D/pki/914840a0
  # build-ca; mktemp_counter: 8 uses
  # build-ca; cleanup: lock-file REMOVED OK
  # build-ca; Exit: Final Success = true
tct@wiscii:~/git/easy-rsa/test/installed/test D$ EASYRSA_OPENSSL=/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl easyrsa --verbose --batch --nopass gen-dh
  # gen-dh: verify_working_env; select_vars; No vars
  # gen-dh: verify_working_env; default_vars; defaults set OK
  # gen-dh: verify_working_env; mutual_exclusions; COMPLETED
  # gen-dh: verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl)
  # gen-dh: verify_working_env; request_lock_file; lock-file CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/lock.file
  # gen-dh: verify_working_env; secure_session; CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1
  # gen-dh: verify_working_env; easyrsa_mktemp; test_temp_file /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.00
  # gen-dh: verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.01
  # gen-dh: verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # gen-dh: verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.01
  # gen-dh: verify_working_env; verify_algo_params; OK: algo 'rsa' | curve ''
  # gen-dh: verify_working_env; locate_support_files; EASYRSA_EXT_DIR: built-in
  # gen-dh: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: built-in
  # gen-dh; easyrsa_mktemp; tmp_dh_file /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.02
  # gen-dh; easyrsa_openssl; BEGIN dhparam
  # gen-dh; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.01
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................*
  # gen-dh; easyrsa_openssl; END dhparam
  # gen-dh; easyrsa_openssl; BEGIN dhparam
  # gen-dh; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1/temp.01
DH parameters appear to be ok.
  # gen-dh; easyrsa_openssl; END dhparam

Notice
------

DH parameters of size 2048 created at:
* /home/tct/git/easy-rsa/test/installed/test D/pki/dh.pem

  # gen-dh; remove_secure_session; DELETED /home/tct/git/easy-rsa/test/installed/test D/pki/3e4379a1
  # gen-dh; mktemp_counter: 3 uses
  # gen-dh; cleanup: lock-file REMOVED OK
  # gen-dh; Exit: Final Success = true
tct@wiscii:~/git/easy-rsa/test/installed/test D$ EASYRSA_OPENSSL=/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl easyrsa --verbose --batch --nopass gen-crl
  # gen-crl: verify_working_env; select_vars; No vars
  # gen-crl: verify_working_env; default_vars; defaults set OK
  # gen-crl: verify_working_env; mutual_exclusions; COMPLETED
  # gen-crl: verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (/home/tct/libressl/libressl-4.1.0/apps/openssl/openssl)
  # gen-crl: verify_working_env; request_lock_file; lock-file CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/lock.file
  # gen-crl: verify_working_env; secure_session; CREATED /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293
  # gen-crl: verify_working_env; easyrsa_mktemp; test_temp_file /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.00
  # gen-crl: verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.01
  # gen-crl: verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # gen-crl: verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.01
  # gen-crl: verify_working_env; verify_algo_params; OK: algo 'rsa' | curve ''
  # gen-crl: verify_working_env; locate_support_files; EASYRSA_EXT_DIR: built-in
  # gen-crl: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: built-in
  # gen-crl; easyrsa_mktemp; out_file_tmp /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.02
  # gen-crl; easyrsa_openssl; BEGIN ca
  # gen-crl; easyrsa_openssl; OPENSSL_CONF = /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.01
Using configuration from /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293/temp.01
  # gen-crl; easyrsa_openssl; END ca

Notice
------
An updated CRL DER copy has been created:
* /home/tct/git/easy-rsa/test/installed/test D/pki/crl.der

An updated CRL has been created:
* /home/tct/git/easy-rsa/test/installed/test D/pki/crl.pem

IMPORTANT: When the CRL expires, an OpenVPN Server which uses a
CRL will reject ALL new connections, until the CRL is replaced.

  # gen-crl; remove_secure_session; DELETED /home/tct/git/easy-rsa/test/installed/test D/pki/fae74293
  # gen-crl; mktemp_counter: 3 uses
  # gen-crl; cleanup: lock-file REMOVED OK
  # gen-crl; Exit: Final Success = true
tct@wiscii:~/git/easy-rsa/test/installed/test D$ 

I guess your high security system is fallable.

[TinCanTech]

My guess, which is something that you should know, is that your seclevel forbids RSA keys with only 2048 bits. Please consult your OS documentation.

[crickc]

Easy-rsa release still include the file openssl-easyrsa.cnf and it is used by default.

# gen-crl: verify_working_env; locate_support_files; EASYRSA_SSL_CONF: /srv/vpn_new_bug/openssl-easyrsa.cnf

There must be a missing variable in openssl-easyrsa.cnf because forcing EASYRSA_SSL_CONF to the built-in value work for me ...

[TinCanTech]

From your original post:

EasyRSA Version Information
Version: 3.2.4
Generated: Wed Aug 27 07:28:22 CDT 2025
SSL Lib: undefined

If the SSL lib is undefined then easyrsa will assume OpenSSL.

With your original openssl-easyrsa.cnf, you can try option --force-safe-ssl.
Which will force the expansion of your current SSL config.

Also, I am trying to build an OpenBSD VM, to test with.

[TinCanTech]

@crickc Can you please post the output of easyrsa --verbose.

[crickc]

The openssl-easyrsa.cnf (/srv/vpn_new_bug/openssl-easyrsa.cnf) is the file included in easy-rsa release package (without modification).
Just run your previous test ( #1390 (comment) ) with EASYRSA_SSL_CONF pointing to openssl-easyrsa.cnf (instead of using the built-in value) and you should get my error.

[crickc]

As requested:

./easyrsa --verbose                                
  # : verify_working_env; select_vars; selected /srv/vpn_new_bug/vars
Using Easy-RSA 'vars' configuration:
* /srv/vpn_new_bug/vars
  # : verify_working_env; source_vars; sourced /srv/vpn_new_bug/vars
  # : verify_working_env; mutual_exclusions; COMPLETED
  # : verify_working_env; verify_ssl_lib; LibreSSL 4.1.0 (openssl)
  # : verify_working_env; secure_session; CREATED /srv/vpn_new_bug/pki/cf5e7a06
  # : verify_working_env; easyrsa_mktemp; test_temp_file /srv/vpn_new_bug/pki/cf5e7a06/temp.00
  # : verify_working_env; easyrsa_mktemp; global_safe_ssl_cnf_tmp /srv/vpn_new_bug/pki/cf5e7a06/temp.01
  # : verify_working_env; write_legacy_file_v2; over-write ENABLED for safe-cnf
  # : verify_working_env; write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = /srv/vpn_new_bug/pki/cf5e7a06/temp.01
  # : verify_working_env; locate_support_files; EASYRSA_EXT_DIR: /srv/vpn_new_bug/x509-types
  # : verify_working_env; locate_support_files; EASYRSA_SSL_CONF: /srv/vpn_new_bug/openssl-easyrsa.cnf

Easy-RSA 3 Overview:

To get a list of available options and commands, use:
  ./easyrsa help

To get detailed usage and help for commands, use:
  ./easyrsa help <COMMAND>

DIRECTORY STATUS (commands would take effect on these locations)
     EASYRSA: /srv/vpn_new_bug
         PKI: /srv/vpn_new_bug/pki
   vars-file: /srv/vpn_new_bug/vars
   Algorithm: ed
       Curve: ed25519
   CA status: OK

    subject= 
    commonName                = Easy-RSA CA

  # ; ssl-cnf: /srv/vpn_new_bug/openssl-easyrsa.cnf
  # ; x509-types: /srv/vpn_new_bug/x509-types
  # ; temp-dir: Found: /srv/vpn_new_bug/pki
  # ; remove_secure_session; DELETED /srv/vpn_new_bug/pki/cf5e7a06
  # ; mktemp_counter: 2 uses
  # ; cleanup: lock-file does not exist.
  # ; Exit: Final Success = true

[TinCanTech]

I have reproduced this error for both gen-crl and gen-dh, now the rabbit-hole looms!

@crickc thanks for reporting this and your help.