diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml
new file mode 100644
index 000000000..01520f9e7
--- /dev/null
+++ b/.github/workflows/action.yml
@@ -0,0 +1,100 @@
+# This is a basic workflow to help you get started with Actions
+
+name: CI
+
+# Controls when the action will run.
+on:
+  # Triggers the workflow on push or pull request events but only for the master branch
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  xtest:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    env:
+      EASYRSA_BY_TINCANTECH: 1
+      EASYRSA_REMOTE_CI: 1
+      EASYRSA_NIX: 1
+      TERM: xterm-256color
+      EASYRSA_SILENT_SSL: 1
+      EASYRSA_SET_ERREXIT: 1
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v5
+
+      # Runs a single command using the runners shell
+      - name: operational test
+        run: sh op-test.sh -vv -p
+
+      # Runs a set of commands using the runners shell
+      # - name: Run a multi-line script
+      #    run: |
+      #      echo Add other actions to build,
+      #      echo test, and deploy your project.
+      # This workflow contains a single job called "build"
+
+  wtest:
+    # The type of runner that the job will run on
+    runs-on: windows-latest
+
+    env:
+      EASYRSA_REMOTE_CI: 1
+      EASYRSA_WIN: 1
+      EASYRSA_WIN_QUICK: 1
+      TERM: xterm-256color
+      EASYRSA_SILENT_SSL: 1
+      EASYRSA_SET_ERREXIT: 1
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v5
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: cmd /c wop-test.bat
+
+      # Runs a set of commands using the runners shell
+      # - name: Run a multi-line script
+      #    run: |
+      #      echo Add other actions to build,
+      #      echo test, and deploy your project.
+
+  mtest:
+    # The type of runner that the job will run on
+    runs-on: macos-latest
+
+    env:
+      EASYRSA_REMOTE_CI: 1
+      # Limit run to RSA and EC only, Libre does not do ED
+      #LIBRESSL_LIMIT: 1
+      EASYRSA_MAC: 1
+      TERM: xterm-256color
+      EASYRSA_SILENT_SSL: 1
+      EASYRSA_SET_ERREXIT: 1
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v5
+
+      # Runs a single command using the runners shell
+      - name: Run a one-line script
+        run: sh op-test.sh -v -p
+
+      # Runs a set of commands using the runners shell
+      # - name: Run a multi-line script
+      #    run: |
+      #      echo Add other actions to build,
+      #      echo test, and deploy your project.
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000..ed672722a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+easyrsa3/pki
+easyrsa3/vars
+easyrsa3/safessl-easyrsa.cnf
+easyrsa3/unit?tests
+easyrsa-unit-tests.sh
+easyrsa-unit-tests-help.sh
+dist-staging
+.DS_Store
+test-deps/*
+shellcheck
diff --git a/COPYING b/COPYING.md
similarity index 91%
rename from COPYING
rename to COPYING.md
index 25b910e77..39bce088f 100644
--- a/COPYING
+++ b/COPYING.md
@@ -1,15 +1,16 @@
 Easy-RSA -- A Shell-based CA Utility
+====================================
 
 Copyright (C) 2013 by the Open-Source OpenVPN development community
 
-Easy-RSA 3 license: GPLv2:
+Easy-RSA 3 license: GPLv2
 -------------------------
 
 All the Easy-RSA code contained in this project falls under a GPLv2 license with
 full text available in the Licensing/ directory. Additional components used by
 this project fall under additional licenses:
 
-Additional licenses for external components:
+Additional licenses for external components
 -------------------------------------------
 
 The following components are under different licenses; while not part of the
diff --git a/ChangeLog b/ChangeLog
index 911950d0a..e23eaae14 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,494 @@
 Easy-RSA 3 ChangeLog
 
+3.2.7 (TBD)
+
+   * Minor changes required to support Git Bash for Windows
+     (ade5653) (dd55451) (f2591fc) (5d389e4) (cb1c437) (#1454)
+     To use Git Bash for Windows set 'EASYRSA_RAND_SN=no'
+   * write: Load all variables before calling 'write()' (3c9e340) (#1451)
+   * verify_working_env(): Do not reset '$require_pki' and '$require_ca' (9d34430) (#1450)
+   * Remove EASYRSA_SAN_CRIT from 'Add full --san to extra extensions' (19c10ab) (#1448)
+   * default_vars(): If defined, set EASYRSA_SAN_CRIT to 'critical,' (97e1020) (#1448)
+
+3.2.6 (2026-03-13)
+
+   * Introduce command 'import-tls-key' - Import an OpenVPN TLS key (cb4735b) (#1429)
+   * X509-Type ca: Enable 'basicConstraints = critical' for CA/subCA certificates
+     (5a5adb4) (#1428) - Original discussion: #1418
+   * inline_file(): $inline_incomplete, add descriptive message (0df7946) (#1423)
+   * Introduce new command 'import-ca' (fae716f) (#1423)
+   * inline_file(): Introduce external CA list file (ce61d91) (#1423)
+   * set_no_clobber(): Try shell long option 'set -o noclobber' first (87e31ce) (#1421)
+   * CI: Enable shell switch errexit, set by env-var $EASYRSA_SET_ERREXIT (772d6f6) (#1417)
+
+3.2.5 (2025-12-13)
+
+   * ssl_cert_digest(): Support Edwards curve with LibreSSL (1eaa31e) (#1415)
+   * New function ssl_cert_sig_digest() (f9d2b49) (#1414)
+   * Add '-b' alias for --batch (575a964) (#1411)
+   * Introduce peer-fingerprint inline lists (94c3690) (#1410)
+   * Create new inline file type 'pfp', peer-fingerprint (353adc5) (#1407)
+   * export_pkcs(), PKCS12 inline: Respect $EASYRSA_NO_INLINE (35d7ad3) (#1407)
+     Original bug report: Sébastien Luttringer (#1406)
+   * Introduce global option --force-vars (5560d3c) (#1405)
+   * source_vars(): Add 'set -e' to dry-run, sub-shell sourcing vars (6598711) (#1405)
+   * source_vars(): Add grep check for assignment by '=' (fc36545) (#1405)
+   * Update EasyRSA-Advanced.md (276eaa5) (#1403)
+   * Introduce global option --no-inline (75e52f7) (#1403)
+   * Replace $ignore_vars with $EASYRSA_NO_VARS (Revert 3c0ca17) (5879488) (#1403)
+   * Libressl: Use ONLY $EASYRSA_FORCE_SAFE_SSL (25b7485) (#1402)
+   * select_x509_type_tmp(): This compliments select_ssl_cnf_tmp() (dc754e4) (#1401)
+   * select_ssl_cnf_tmp(): Replace provide_EASYRSA_SSL_CONF_tmp() (538ad3d) (#1401)
+   * inline_file(): Make unknown certificate type non-fatal (b2373e2) (#1399)
+   * Remove 'kdc' as a 'built-in' X509-type (13e37d9) (#1399)
+   * peer-fingerprint: Allow 'show-cert' to be used (7cf55e0) (#1397)
+   * init-pki: Introduce configurable cryptography (a8da392) (#1397)
+
+   * Update OpenSSL for Windows to 3.6.0 (62a0cea)
+   * Replace "local" openssl-easyrsa.cnf (80702d6..b31443d) (#1394)
+
+     Original bug report: #1390 'OpenBSD/LibreSSL failure'
+
+     With these changes, Easy-RSA now does the following:
+
+     Create a global safe SSL config file exactly as before and export it
+     to $OPENSSL_CONF, for use by any SSL library. This file is specifically
+     required by check_serial_unique(), which must have the Easy-RSA CA
+     configured file.
+
+     Use either an existing openssl-easyrsa.cnf file OR provide a default,
+     unexpanded tmp-file, which is exported to $EASYRSA_SSL_CONF, for use
+     ONLY by Easy-RSA. This must be unexpanded to allow $EASYRSA_REQ_CN to
+     be configured by the Easy-RSA command in use (eg. sign-req) once the
+     Easy-RSA command line has been fully parsed.
+
+     When calling easyrsa_openssl(), for LibreSSL or --force-safe-ssl,
+     expand the current $EASYRSA_SSL_CONF and export that to $OPENSSL_CONF,
+     for use by the called SSL command. Otherwise, use the current, unexpanded
+     file and export that.
+
+3.2.4 (2025-08-27)
+
+   * build-ca: get_passphrase(), write passphrase directly to temp-file (0cb9cdd)
+   * create_legacy_stream(): Designate 'selfsign' as NOT user configurable (f564b1c) (#1383)
+   * self_sign(): awk action, correct comment and reduce script (8e23ba3) (#1383)
+   * forbid_selfsign(): Allow issuer certificate serial to be absent (09dffec) (#1383)
+     Original bug report: github-user topical (#1382)
+   * self_sign(): Force use of Easy-RSA X509-type file 'selfsign' (7e39cc6) (#1383)
+   * random: Use verify_working_env() to configure EASYRSA_OPENSSL (32eb73d) (#1381)
+   * set_no_clobber(): Add simple error detection (0f93880) (#1379)
+   * revoke: Archive request and private key files and expand help (79754da) (#1378)
+     Original bug report: github-user spacefreak86 (#1377)
+   * Remove 'easyrsa_mkdir()', use only 'mkdir' (5738f3d) (#1376)
+   * help: Correct build-ca 'rawca' command option (0447f42) (#1374)
+   * Windows easyrsa-shell-init.sh: Modernize prompt (5bf2e99) (#1374)
+   * Windows UT: Update 'wop-test.sh' to latest 'easyrsa-shell-init.sh' (ea5b168) (#1374)
+   * verify_openvpn(): Convert Windows path '\' to *nix path '/' (75a8fdd) (#1374)
+   * verify_openvpn(): Windows, add check for 'openvpn.exe' (10c6267) (#1374)
+   * gen-crl: Replace file-move with file-copy-preserve-attribs (4cc1d48) (#1374)
+   * Windows easyrsa-shell-init.sh: Add non-fatal check for 'openvpn.exe' (bb78615) (#1374)
+   * Windows easyrsa-shell-init.sh: Require confirmation for User-Home mode (bfa6cfd) (#1374)
+   * Windows easyrsa-shell-init.sh: Allow Easy-RSA to use '\User\$HOME' (f194da5) (#1374)
+   * mutual_exclusions(): Include basic checks for --startdate/--enddate (e1478c3) (#1372)
+   * Windows easyrsa-shell-init.sh: Replace 'read -p' (49b2181) (#1371)
+   * inline: Include missing OpenVPN TLS key to cause INCOMPLETE warning (d98eee6) (#1368)
+   * Verbose: Make verbose messages command and function aware (7634b94) (#1368)
+   * CI: Add OpenSSL-3.5.1-LTS and LibreSSL-4.1.0 to private test suite
+   * secure_session(): Remove unnecessary check for existing directory (1322177) (#1367)
+   * all_legacy_files_v2(): Do not create PKI directory (b0260da) (#1367)
+   * Replace PKI and CA initialisation flags with command switch flags (2bdf582) (#1367)
+   * verify_working_env(): Move lock-file request to after PKI check (071405d) (#1367)
+   * Move basic sanity checks to verify_working_env() (509a36e) (#1367)
+   * New global option: --no-lockfile = env-var: $EASYRSA_NO_LOCKFILE (46c8647) (#1364)
+   * default_overview(): Add peer-fingerprint mode PKI identification (c9a0152) (#1363)
+   * help: Add in use algorithm and key-size/curve to top level status (10778cc) (#1363)
+   * help: Move 'utils' to command list and detailed help (e965234) (#1363)
+   * Restructure help (65c2bce) (#1363)
+   * export-p12: Split $p12_cipher_opts into respective parts (48bb8ee) (#1356)
+   * export-p12: Move inline file to 'inline/private' folder (22cabcb) (#1356)
+   * export-p12: Rename inline file extension to '.inline-p12' (22cabcb) (#1356)
+
+3.2.3 (2025-06-12)
+
+   * build-ca: Remove TLS Key processing (c1c2a06) (#1351)
+   * init-pki: Remove option 'soft' and TLS Key processing (976f864) (#1351)
+   * peer-fingerprint mode: Make CA mode mutually exclusive to PFP mode (8c1c435) (#1347)
+   * TLS key generation: Allow 'gen-tls-auth/crypt-key' without a CA Cert (2580dc2) (#1345)
+   * Inline_file(): Improvements self-signed integration (bc72a21) (#1345)
+   * verify_pki_init(): Always create 'issued' dir (f7e1b79) (#1343)
+   * inline_file(): Use ssl_cert_serial() (c0d2e82) (#1343)
+   * forbid_selfsign(): Compare cert serial to signing cert serial (29b2779) (#1342)
+   * Unit-test: Minimize Windows test (dc60c8b) (#1339)
+   * ssl_cert_x509v3_eku(): Localize variables and minor improvements (8c19a95) (#1337)
+   * inline_file(): Always use ssl_cert_x509v3_eku() to set $inline_crt_type (e1a2880) (#1337)
+   * sign-req: Disable inline for certificate type 'ca' (sub-ca) (f1252a3) (#1337)
+   * inline_file(): Localize variables $inline_crt_type & $inline_crt_CN (692e20a) (#1337)
+   * add_critical_attrib(): export temp-file name as input file (e5b8d97) (#1333)
+   * Unit-test: Drop old *nix test (63f3869) (#1335)
+   * Always export EASYRSA_SSL_CONF, when assigned (code standard) (e77240d) (#1334)
+   * show-expire: Move setting $pre_expire_window_s to status() (4b05181) (#1332)
+     Original bug report: Antonio Gurgel (#1331)
+   * inine_file(): Correct logic and add 'dh none' for DH params file (7d5c52e) (#1330)
+   * Update Copyright 2025 (8586bcf) (#1327)
+   * secure_session(): Use new easyrsa_mkdir() to create session dir (41c154c) (#1324)
+   * easyrsa_mkdir(): Separate Windows from *nix (7c76540) (#1324)
+   * easyrsa_mktemp(): Remove secondary atomic operation (1a44c33) (#1322)
+   * will_cert_be_valid(): Remove SSL option -noout (9c8465e) (#1321)
+   * New option --text: Create CSR files with human readable text (c152118) (#1319)
+   * Command 'write': Remove options 'overwrite' and 'filename' (153ec6f) (#1318)
+   * easyrsa_mktemp(): Change usage to not check for errors (64c201a) (#1315)
+   * New function set_no_clobber() (e4c229c) (#1314)
+   * Introduce "robust" lock-file mechanism (ff22f82) (#1313)
+     Original bug report: ARNOLD Somogyi (#1279)
+   * Introduce command line options --umask|--no-umask (d1b030d) (#1312)
+   * Fix shellcheck warnings:
+     (e28a35c) (6082f6f) (e0ec835) (e0e798a) (85b1086) (#1311)
+   * inline_file(): Include DH file or placeholder, for RSA Servers (8a7b1fa) (#1310)
+   * add_critical_attrib(): Do not add 'critical' if it exists (cdfaf61) (#1308)
+     Original bug report: Dmitry Kononov (#1306)
+   * select_vars(): Minor improvements (12ecc1a) (#1300)
+   * expire_status_v2(): Refactor 'if' to capture -date error (52dafed) (#1304)
+   * Reinstate old function as 'db_date_to_iso_8601()' (0444ad3) (#1303)
+   * Remove all references to file:easyrsa-tools.lib (e1c8386) (#1298)
+   * Correctly define options names - Remove wild-card pattern (d145504) (#1297)
+   * check_serial_unique(): Check for duplicate Subject error (be8467f) (#1294)
+   * renew: Print 'unique_subject = no' to index.txt.attr (857a4e7) (#1293)
+   * Update OpenSSL to 3.4.0 (d020b66) 
+   * Update OpenSSL to 3.5.0 (bcc2d33)
+
+3.2.2 (2025-02-01)
+
+   * Fold easyrsa-tools.lib into easyrsa (56cfa0c) (#1288)
+   * Revert da3c249: Do not remove index.txt.attr (a236b97) (#1287)
+   * Windows: Remove mktemp binary and text files (135f642) (#1285)
+   * op-test.sh: Disable download ossl3 and shellcheck binaries (473c43b) (#1284)
+   * Forbid self-signed certificate from being expired/renewed/revoked (ab45ae7) (#1274)
+   * Rename global option --ssl-conf (DEPRECATED) to --ssl-cnf (c788423) (#1270)
+   * bugfix: Save and Restore $EASYRSA_SSL_CONF for compound commands (7cdb14d) (#1270)
+   * bugfix: Always use locate_support_files() after secure_session() (d530bc3) (#1270)
+   * bugfix: easyrsa-tools.lib: renew, write full metadata to temp-file (b47d2af) (#1267)
+   * Introduce new command 'revoke-issued' (38bf2d8) (#1266)
+     Commands 'revoke' and 'revoke-issued' are identical.
+     Command 'revoke' can ONLY be used in batch mode.
+   * vars.example: Remove $EASYRSA_PKI (8ee8dcf) (#1262)
+     There is no effect on existing 'vars' files.
+   * easyrsa-tools.lib: Move to 'easyrsa3' directory (d30b688) (#1259)
+     This now includes 'easyrsa-tools.lib' in the distribution tarballs.
+   * Upgrade easyrsa-tools.lib to version 322 - As of command 'renew-ca'
+   * easyrsa-tools.lib: Introduce new command 'renew-ca' (ba32b0d) (#1255)
+   * easyrsa-tools.lib: show-expire, allow --days to be zero (a1033a5) (#1254)
+   * Command 'help': Ignore EASYRSA_SILENT (8804d6b) (#1249)
+   * bugfix: easyrsa-tools.lib: renew SAN, remove excess word 'Address' (af17492) (#1251)
+   * New global variable 'EASYRSA_DISABLE_INLINE' (ad257ab) (#1245)
+   * bugfix: revoke, renew: Remove pki/inline/private/$file.inline (febef85) (#1244)
+     Initial bug report #1242 (Minor)
+     Stop removing old credentials file pki/$file.creds (a871e9c)
+   * Add LibreSSL version 4 to supported SSL Libraries (7df616b) (#1240)
+   * sign-req: Allow custom X509 Types (2ee08cc) (#1238)
+   * Remove redundant file index.txt.attr (da3c249) (#1233)
+
+3.2.1 (2024-09-13)
+
+   * inline: Add decimal value for cert. serial (Linux Only) (b33038e) (#1222)
+   * Always exit with error for unknown command options (Except nopass) (#1221)
+     (build-ca: b2f7912); (gen-req: 07f21d3); (build_full(): 0ff7f4c);
+     (export_pkcs(): 2c51288); (set-pass: 1266d4e)
+   * Integrate Easy-RSA TLS-Key for use with 'init-pki soft' (03d9dc2) (#1220)
+     Note: Inline files that contain private key data are now created in sub-dir
+     'pki/inline/private'.
+   * easyrsa-tools.lib, show-expire: Add CA certificate to report (a36cd54) (#1215)
+   * inline: OpenVPN TLS Keys inlining for TLS-AUTH, TLS-CRYPT-V1 (6e9e4a2) (#1185)
+     Note: Command inline only writes directly to inline file not stdout.
+   * easyrsa-tools.lib: OpenVPN TLS Key gen. TLS-AUTH, TLS-CRYPT-V1 (cf0da16) (#1185)
+   * easyrsa-tools.lib: expire_status_v2() (show-expire version 2) (1e43bf5) (#1214)
+   * sign-req: Require 128bit serial number (806ee19) (#1213)
+   * Move command 'verify-cert' to Tools-lib; drop 'verify' shortcut (ddbf304) (#1209)
+   * Windows secure_session(): Ensure $secured_session dir is created (d99b242) (#1203)
+   * Switch to '-f' for file existence (6ab98c9..a02f545) (#1201)
+   * inline: Move auto-inline from build_full() to sign_req() (823f70f) (#1201)
+   * gen-crl: Create additional CRL in DER format (69df0d8) (#1198)
+   * self-sign: Allow Edwards Curve based keys (81b749b) (#1197)
+   * Re-enable command 'renew' (version 2): Requires EasyRSA Tools (30fe311) (#1195)
+   * bug-fix: revoke: Pass the correct certificate location (24d5514)
+   * vars.example: Add flags for auto-SAN and X509 critical attribute (a41dfcc)
+   * Global option --eku-crit: Mark X509 extendedKeyUsage as critical (ca09211)
+   * sign-req: Add critical and pathlen details to confirmation (deae705) (#1182)
+   * export-p12: Automatically generate inline file (9d90370) (#1181)
+   * Introduce global option --auto-san, use commonName as SAN (5c36d44) (#1180)
+   * Introduce global option --san-crit, mark SAN critical (dd69f50) (#1179)
+   * Introduce new global options: --ku-crit and --bc-crit (b79abee) (#1176)
+   * gen-req: Always check for existing request file (7eab98e) (#1177)
+   * revoke/revoke-expired/-renewed: Keep duplicate certificate (3da7f66) (#1177)
+   * revoke-expired/-renewed: Keep req/key files for resigning (4537ae7) (#1177)
+   * revoke: Add abbreviations for optional 'reason' (a88ccc7) (#1173)
+   * build-ca: Allow use of --req-cn without batch mode (b77a0fb) (#1170)
+   * gen-req: Re-enable use of --req-cn (5cf8c46) (#1170)
+   * write: Change syntax, target as file, not directory (722ce54) (#1165)
+
+3.2.0 (2024-05-18)
+
+   * Revert ca76697: Restore escape_hazard() (b1e9d7a) (#1137)
+   * New X509 Type: 'selfsign' Internal only (999533e) (#1135)
+   * New commands: self-sign-server and self-sign-client (9f8a1d1) (#1127)
+   * build-ca: Command 'req', remove SSL option '-keyout' (4e02c8a) (#1123)
+     Resolve CVE-2024-13454 - Original bug report: Marcus Stoegbauer (#1122)
+     https://community.openvpn.net/Security%20Announcements/CVE-2024-13454
+   * Remove escape_hazard(), obsolete (ca76697)
+   * Remove command and function display_cn(), unused (be8f400) (#1114)
+   * Introduce Options to edit Request Subject during command 'sign-req'
+     Global Option: --new-subject -- Command 'sign-req' option: 'newsubj'
+     First proposed in: (#439) -- Completed: (83b81c7) (#1111)
+   * docs: Update EasyRSA-Renew-and-Revoke.md (f6c2bf5) (#1109)
+   * Remove all 'renew' code; replaced by 'expire' code (9d94207) (#1109)
+   * Introduce commands: 'expire' and 'revoke-expired' (a1890fa) (#1109)
+   * Keep request files [CSR] when revoking certificates (6d6e8d8) (#1109)
+   * Restrict use of --req-cn to build-ca (0a46164) (#1098)
+   * Remove command 'display-san' (Code removed in 5a06f94) (50e6002) (#1096)
+   * help: Add 'copyext'; How to use --copy-ext and --san (5a06f94) (#1096)
+   * Allow --san to be used multiple times (5a06f94) (#1096)
+   * Remove default server subject alternative name (0b85a5d) (#576)
+   * Move Status Reports to 'easyrsa-tools.lib' (214b909) (#1080)
+   * export-p12, OpenSSL v1.x: Upgrade PBE and MAC options (60a508a)
+     (#1084 - Based on #1081)
+   * Windows: Introduce 'Non-Admin' mode (c2823c4) (#1073)
+   * LibreSSL: Add fix for missing 'x509' option '-ext' (96dd959) (#1068)
+   * Variable heredoc expansion for SSL/Safe Config file (9c5d423) (#1064)
+
+   Branch-merge: v3.2.0-beta2 (#1055) 2024/01/13 Commit: d51d79b
+
+   * Always use here-doc version of openssl-easyrsa.cnf (2a8c0de)
+     Only use here-doc if the current version is recognised by sha256 hash.
+     The current file is NEVER deleted (60216d5). Partially revert: 2a8c0de
+   * export-p12: New command option 'legacy'. OpenSSL V3 Only (f8514de)
+     Fallback to encryption algorithm RC2_CBC or 3DES_CBC
+   * export-p12: Always set 'friendlyName' to file-name-base (da9e594)
+   * Update OpenSSL to 3.2.0 (03e4829)
+
+   Branch-merge: v3.2.0-beta1 (#1046) 2023/12/15 Commit: 7120876
+
+   * Important note: As of Easy-RSA version 3.2.0-beta1, the configuration files
+     `vars.example`, `openssl-easyrsa.cnf` and all files in `x509-types` directory
+     are no longer required. Package maintainers can omit these files in the future.
+     All files are created as required and deleted upon command completion.
+     `vars.example` is created during `init-pki` and placed in the fresh PKI.
+     These files will be retained for downstream packaging compatibility.
+
+   * Rename X509-type file `code-signing` to `codeSigning` (1c6b31a)
+     The original file will be retained as `code-signing`, however, the automatic
+     X509-types creation will name the file `codeSigning`. This effectively means
+     that both are valid X509-types, until `code-signing` is dropped.
+   * init-pki: Always write vars.example file to fresh PKI (66a8f3e)
+   * New command 'write': Write 'legacy' files to stdout or files (c814e0a)
+   * Remove command 'make-safe-ssl': Replaced by command 'write safe-cnf' (c814e0a)
+   * New Command 'rand': Expose easyrsa_random() to the command line (6131cbf)
+   * Remove function 'set_pass_legacy()' (7470c2a)
+   * Remove command 'rewind-renew' (72b4079)
+   * Remove command 'rebuild' (d6953cc)
+   * Remove command 'upgrade' (6a88edd)
+
+   Branch-merge: v3.2.0-alpha2 (#1043) 2023/12/7 Commit: ed0dc46
+   * Remove EASYRSA_NO_VARS; Allow graceful use without a vars file (3c0ca17)
+
+   Branch-merge: v3.2.0-alpha1 (#1041) 2023/12/2 Commit: 42c2e95
+   * New diagnostic command 'display-cn' (#1040)
+   * Expand renewable certificate types to include code-signing (#1039)
+
+3.1.7 (2023-10-13)
+   * Rewrite vars-auto-detect, adhere to EasyRSA-Advanced.md (#1029)
+     Under the hood, this is a considerable change but there are no user
+     noticeable differences. With the exception of:
+     Caveat: The default '$PWD/pki/vars' file is forbidden to change either
+             EASYRSA or EASYRSA_PKI, which are both implied by default.
+   * EasyRSA-Advanced.md: Correct vars-auto-detect hierarchy (#1029)
+     Commit: ecd65065e3303da78811278a154ef7a969c2777b
+             EASYRSA/vars is moved to a higher priority than a default PKI.
+             vars-auto-detect no longer searches 'easyrsa' program directory.
+   * gen-crl: preserve existing crl.pem ownership+mode (#1020)
+   * New command: make-vars - Print vars.example (here-doc) to stdout (#1024)
+   * show-expire: Calculate cert. expire seconds from DB date (#1023)
+   * Update OpenSSL to 3.1.2
+
+3.1.6 (2023-07-18)
+   * New commands: 'inline' and 'x509-eku' (#993)
+     inline: Build an inline file for a commonName
+     x509-eku: Extract X509v3 extended key usage from a certificate
+   * Expose serial-check, display-dn, display-san and default-san to
+     command line. (#980) (Debugging functions, which remain undocumented)
+   * Expand default status to include vars-file and CA status (#973)
+   * sign-req: Allow the CSR DN-field order to be preserved (#970)
+
+3.1.5 (2023-06-10)
+   * Build Update: script now supports signing and verifying
+   * Automate support-file creation (Free packaging) (#964)
+   * build-ca: New command option 'raw-ca', abbreviation: 'raw' (#963)
+
+     This 'raw' method, is the most reliable way to build a CA,
+     with a password, without writing the CA password to a temp-file.
+
+   This option completely replaces both methods below:
+
+   * build-ca: New option --ca-via-stdin, use SSL -pass* argument 'stdin' (#959)
+     Option '--ca-via-stdin' offers no more security than standard method.
+     Easy-RSA version 3.1.4 ONLY.
+
+   * build-ca: Replace password temp-files with file-descriptors (#955)
+     Using file-descriptors does not work in Windows.
+     Easy-RSA version 3.1.3 ONLY.
+
+3.1.4 (2023-05-23)
+   * build-ca: New option --ca-via-stdin, use SSL -pass* argument 'stdin' (#959)
+   * build-ca: Revert manual CA password method to temp-files (#959)
+     Supersedes #955
+
+     Release v3.1.3 was fatally flawed, it would fail to build a CA under Windows.
+     Release v3.1.4 is specifically a bugfix ONLY, to resolve the Windows problem.
+
+     See the following commits for further details:
+     5d7ad1306d5ebf1588aef77eb3445e70cf5b4ebc
+         build-ca: Revert manual CA password method to temp-files
+     c11135d19b2e7e7385d28abb1132978c849dfa74
+         build-ca: Use OpenSSL password I/O argument 'stdin'
+     27870d695a324e278854146afdac5d6bdade9bba
+         build-ca: Replace password temp-file method with file-descriptors
+         Superseded by 5d7ad13 above.
+
+3.1.3 (2023-05-19)
+   * build-ca: Replace password temp-files with file-descriptors (#955)
+     Superseded by #959
+   * Replace --fix-offset with --startdate, --enddate (#918)
+   * Introduce option -S|--silent-ssl: Silence SSL output (#913)
+   * Only create a random serial number file when expected (#896)
+   * Always verify SSL lib, for all commands (#877)
+   * Option --fix-offset: Adjust off-by-one day (#847) Superseded (#918)
+   * Update OpenSSL to v3.0.8
+
+3.1.2 (2023-01-13)
+   * build-full: Always enable inline file creation (#834)
+   * Make default Edwards curve ED25519 (#828)
+   * Allow --fix-offset to create post-dated certificates (#804) Superseded (#918)
+   * Introduce command 'set-pass' (#756)
+   * Introduce global option '--nopass|--no-pass' (#752)
+   * Introduce global option '--notext|--no-text' (#745)
+   * Command 'help': For unknown command, exit with error (#737)
+   * Find data-files in the correct order (#727 - Reported #725)
+   * Update OpenSSL to 3.0.7 for Windows distribution
+
+3.1.1 (2022-10-13)
+   * Remove command 'renewable' (#715)
+   * Expand 'show-renew', include 'renewed/certs_by_serial' (#700)
+   * Resolve long-standing issue with --subca-len=N (#691)
+   *  ++ NOTICE: Add EasyRSA-Renew-and-Revoke.md (#690)
+   * Require 'openssl-easyrsa.cnf' is up to date (#695}
+   * Introduce 'renew' (version 3). Only renew cert (#688)
+   * Always ensure X509-types files exist (#581 #696)
+   * Expand alias '--days' to all suitable options with a period (#674)
+   * Introduce --keep-tmp, keep temp files for debugging (#667)
+   * Add serialNumber (OID 2.5.4.5) to DN 'org' mode (#606)
+   * Support ampersand and dollar-sign in vars file (#590)
+   * Introduce 'rewind-renew' (#579)
+   * Expand status reports to include checking a single cert (#577)
+   * Introduce 'revoke-renewed' (#547)
+   * update OpenSSL for Windows to 3.0.5
+
+3.1.0 (2022-05-18)
+   * Introduce basic support for OpenSSL version 3 (#492)
+   * Update regex in grep to be POSIX compliant (#556)
+   * Introduce status reporting tools (#555 & #557)
+   * Display certificates using UTF8 (#551)
+   * Allow certificates to be created with fixed date offset (#550)
+   * Add 'verify' to verify certificate against CA (#549)
+   * Add PKCS#12 alias 'friendlyName' (#544)
+   * Support multiple IP-Addresses in SAN (#564)
+   * Add option '--renew-days=NN', custom renew grace period (#557)
+   * Add 'nopass' option to the 'export-pkcs' functions (#411)
+   * Add support for 'busybox' (#543)
+   * Add option '--tmp-dir=DIR' to declare Temp-dir (Commit f503a22)   
+
+3.0.9 (2022-05-17)
+   * Upgrade OpenSSL from 1.1.0j to 1.1.1o (#405, #407) 
+      - We are building this ourselves now.
+   * Fix --version so it uses EASYRSA_OPENSSL (#416)
+   * Use openssl rand instead of non-POSIX mktemp (#478)
+   * Fix paths with spaces (#443)
+   * Correct OpenSSL version from Homebrew on macOs (#416)
+   * Fix revoking a renewed certificate (Original PR #394)
+     Follow-up commit: ef22701878bb10df567d60f2ac50dce52a82c9ee
+   * Introduce 'show-crl' (d1993892178c5219f4a38d50db3b53d1a972b36c)
+   * Support Windows-Git 'version of bash' (#533)
+   * Disallow use of single quote (') in vars file, Warning (#530)
+   * Creating a CA uses x509-types/ca and COMMON (#526)
+   * Prefer 'PKI/vars' over all other locations (#528)
+   * Introduce 'init-pki soft'  option (#197)
+   * Warnings are no longer silenced by --batch (#523)
+   * Improve packaging options (#510)
+   * Update regex for POSIX compliance (#556)
+   * Correct date format for Darwin/BSD (#559)
+
+3.0.8 (2020-09-09)
+   * Provide --version option (#372)
+   * Version information now within generated certificates like on *nix
+   * Fixed issue where gen-dh overwrote existing files without warning (#373)
+   * Fixed issue with ED/EC certificates were still signed by RSA (#374)
+   * Added support for export-p8 (#339)
+   * Clarified error message (#384)
+   * 2->3 upgrade now errors and prints message when vars isn't found (#377)
+
+3.0.7 (2020-03-30)
+   * Include OpenSSL libs and binary for Windows 1.1.0j
+   * Remove RANDFILE environment variable (#261)
+   * Workaround for bug in win32 mktemp (#247, #305, PR #312)
+   * Handle IP address in SAN and renewals (#317)
+   * Workaround for ash and no set -o echo (#319)
+   * Shore up windows testing framework (#314)
+   * Provide upgrade mechanism for older versions of EasyRSA (#349)
+   * Add support for KDC certificates (#322)
+   * Add support for Edward Curves (#354, #350)
+   * Add support for EASYRSA_PASSIN and EASYRSA_PASSOUT env vars (#368)
+   * Add support for RID to SAN (#362)
+
+3.0.6 (2019-02-01)
+   * Certificates that are revoked now move to a revoked subdirectory (#63)
+   * EasyRSA no longer clobbers non-EASYRSA environment variables (#277)
+   * More sane string checking, allowing for commas in CN (#267)
+   * Support for reasonCode in CRL (#280)
+   * Better handling for capturing passphrases (#230, others)
+   * Improved LibreSSL/MacOS support
+   * Adds support to renew certificates up to 30 days before expiration (#286)
+     - This changes previous behavior allowing for certificate creation using
+       duplicate CNs.
+
+3.0.5 (2018-09-15)
+   * Fix #17 & #58: use AES256 for CA key
+   * Also, don't use read -s, use stty -echo
+   * Fix broken "nopass" option
+   * Add -r to read to stop errors reported by shellcheck (and to behave)
+   * Remove overzealous quotes around $pkcs_opts (more SC errors)
+   * Support for LibreSSL
+   * EasyRSA version will be reported in certificate comments
+   * Client certificates now expire in 3 year (1080 days) by default
+
+3.0.4 (2018-01-21)
+    * Remove use of egrep (#154)
+    * Integrate with Travis-CI (#165)
+    * Remove "local" from variable assignment (#165)
+    * Other changes related to Travis-CI fixes
+	* Assign values to variables defined previously w/local
+    * Finally(?) fix the subjectAltName issues I presented earlier (really
+      fixes #168)
+
+3.0.3 (2017-08-22)
+    * Include mktemp windows binary
+    * copy CSR extensions into signed certificate
+
+
+3.0.2 (2017-08-21)
+    * Add missing windows binaries
+
+
+3.0.1 (2015-10-25)
+    * Correct some packaging errors
+
+
 3.0.0 (2015-09-07)
 
     * cab4a07 Fix typo: Hellman
@@ -10,11 +499,11 @@ Easy-RSA 3 ChangeLog
 
     * 8b42eea Make aes256 default, replacing 3des
         (keros: Github)
-    
+
     * f2f4ac8 Make -utf8 default
         (roubert: Github)
 
-	
+
 3.0.0-rc2 (2014/07/27)
 
     * 1551e5f docs: fix typo
diff --git a/KNOWN_ISSUES b/KNOWN_ISSUES
index 4ede802ef..77f672dde 100644
--- a/KNOWN_ISSUES
+++ b/KNOWN_ISSUES
@@ -1,8 +1,9 @@
-* Issue #24: Incorrect variable name in vars.example
+For a full list of issues, please visit the GitHub issue tracker at
+https://github.com/OpenVPN/easy-rsa/issues
 
-    vars.example does not currently handle un-commenting a line that references
-    a variable that was not also defined earlier with set_var. Currently it is
-    necessary to un-comment the line referencing the used variables.
-
-    When this issue is corrected, this work-around will no longer be necessary.
+* EasyRSA tools, MKSH and mkdir.exe, *may* not work with Windows 11.
+  Requires further investigation.
 
+* OpenSSL 3.x does not appear to work on Windows 7.  Please use EasyRSA v3.0.9
+  if you intend on using Windows 7.  Note that Windows 7 is no longer supported
+  by Microsoft.
diff --git a/Licensing/gpl-2.0.txt b/Licensing/gpl-2.0.txt
index 1f963da0d..d159169d1 100644
--- a/Licensing/gpl-2.0.txt
+++ b/Licensing/gpl-2.0.txt
@@ -337,4 +337,3 @@ proprietary programs.  If your program is a subroutine library, you may
 consider it more useful to permit linking proprietary applications with the
 library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.
-
diff --git a/README b/README
deleted file mode 100644
index 325e7e69e..000000000
--- a/README
+++ /dev/null
@@ -1,39 +0,0 @@
-OVERVIEW:
-easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's terms,
-this means to create a root certificate authority, and request and sign 
-certificates, including sub-CAs and certificate revokation lists (CRL).
-
-DOWNLOADS:
-
-If you are looking for release downloads, please see the releases section on
-GitHub. Releases are also available as source checkouts using named tags.
-
-DOCUMENTATION:
-
-For 3.x project documentation and usage, see the README.quickstart.md file or
-the more detailed docs under the doc/ directory. The .md files are in Markdown
-format and can be converted to html files as desired for release packages, or
-read as-is in plaintext.
-
-GETTING HELP USING EASY-RSA:
-
-Currently, Easy-RSA development co-exists with OpenVPN even though they are
-separate projects. The following resources are good places as of this writing to
-seek help using Easy-RSA:
-
-The openvpn-users mailing list is a good place to post usage or help questions:
-https://lists.sourceforge.net/lists/listinfo/openvpn-users
-
-You can also try IRC at Freenode/#openvpn
-
-BRANCH STRUCTURE:
-
-The easy-rsa master branch is currently tracking development for the 3.x release
-cycle. The prior 2.x and 1.x versions are available as release branches for
-tracking and possible back-porting of relevant fixes. Branch layout is:
-
-  master <- 3.x, at present
-  release/2.x
-  release/1.x
-
-LICENSING info for 3.x is in the COPYING file
diff --git a/README.md b/README.md
new file mode 100644
index 000000000..d7c3074c5
--- /dev/null
+++ b/README.md
@@ -0,0 +1,68 @@
+[![CI](https://github.com/Openvpn/easy-rsa/actions/workflows/action.yml/badge.svg)](https://github.com/Openvpn/easy-rsa/actions/workflows/action.yml)
+# Overview
+
+easy-rsa is a CLI utility to build and manage a PKI CA. In layman's terms,
+this means to create a root certificate authority, and request and sign
+certificates, including intermediate CAs and certificate revocation lists (CRL).
+
+# Downloads
+
+If you are looking for release downloads, please see the releases section on
+GitHub. Releases are also available as source checkouts using named tags.
+
+# Documentation
+
+For 3.x project documentation and usage, see the [README.quickstart.md](README.quickstart.md) file or
+the more detailed docs under the [doc/](doc/) directory. The .md files are in Markdown
+format and can be converted to html files as desired for release packages, or
+read as-is in plaintext.
+
+# Getting help using easy-rsa
+
+Currently, Easy-RSA development co-exists with OpenVPN even though they are
+separate projects. The following resources are good places as of this writing to
+seek help using Easy-RSA:
+
+The [openvpn-users mailing list](https://lists.sourceforge.net/lists/listinfo/openvpn-users)
+is a good place to post usage or help questions.
+
+Users of GitHub can report problems to the Easy-RSA `issues` list.
+
+# Branch structure
+
+The easy-rsa master branch is currently tracking development for the 3.x release
+cycle. Please note that, at any given time, master may be broken. Feel free to
+create issues against master, but have patience when using the master branch. It
+is recommended to use a release, and priority will be given to bugs identified in
+the most recent release.
+
+The prior 2.x and 1.x versions are available as release branches for
+tracking and possible back-porting of relevant fixes.
+
+Branch layout is:
+
+    master             <- Active: v3.2.x - Rolling.
+    v3.<N>.<N>-<LABEL>    Active: Development branches.
+    testing               Sandbox: Subject to change without notice.
+    v3.1.8                Sunset: Bugfix only for v3.1.7
+
+    The following are NOT compatible with OpenSSL version 3:
+
+    v3.0.6                Inactive: Archived.
+    v3.0.5                Inactive: Archived.
+    v3.0.4                Inactive: Archived.
+    release/3.0           Inactive: Archived.
+    release/2.x           Inactive: Archived.
+    release/1.x           Inactive: Unmaintained.
+
+LICENSING info for 3.x is in the [COPYING.md](COPYING.md) file
+
+## Contributing
+
+Please refer to: [doc/EasyRSA-Contributing.md](doc/EasyRSA-Contributing.md)
+
+# Code style, standards
+
+We are attempting to adhere to the POSIX standard, which can be found here:
+
+https://pubs.opengroup.org/onlinepubs/9699919799/
diff --git a/README.quickstart.md b/README.quickstart.md
index 8fb0a2e68..15c818277 100644
--- a/README.quickstart.md
+++ b/README.quickstart.md
@@ -2,17 +2,17 @@ Easy-RSA 3 Quickstart README
 ============================
 
 This is a quickstart guide to using Easy-RSA version 3. Detailed help on usage
-and specific commands by running easyrsa with the 'help' command. Additional
+and specific commands can be found by running ./easyrsa -h.  Additional
 documentation can be found in the doc/ directory.
 
-If you're upgrading from the Easy-RSA 2.x series there are Upgrade-Notes
+If you're upgrading from the Easy-RSA 2.x series, there are Upgrade-Notes
 available, also under the doc/ path.
 
 Setup and signing the first request
 -----------------------------------
 
-A quick run-though of what needs to happen to start a new PKI and sign your
-first entity certificate.
+Here is a quick run-though of what needs to happen to start a new PKI and sign
+your first entity certificate:
 
 1. Choose a system to act as your CA and create a new PKI and CA:
 
@@ -20,10 +20,10 @@ first entity certificate.
         ./easyrsa build-ca
 
 2. On the system that is requesting a certificate, init its own PKI and generate
-   a keypair/request. Note that the init-pki is used _only_ when this is done on
-   a separate system (or at least a separate PKI dir.) This is the recommended
+   a keypair/request. Note that init-pki is used _only_ when this is done on a
+   separate system (or at least a separate PKI dir.) This is the recommended
    procedure. If you are not using this recommended procedure, skip the next
-   import-req step as well.
+   import-req step.
 
         ./easyrsa init-pki
         ./easyrsa gen-req EntityName
@@ -40,12 +40,12 @@ first entity certificate.
 5. Transport the newly signed certificate to the requesting entity. This entity
    may also need the CA cert (ca.crt) unless it had a prior copy.
 
-6. The entity now has its own keypair, and signed cert, and the CA.
+6. The entity now has its own keypair, signed cert, and the CA.
 
 Signing subsequent requests
 ---------------------------
 
-Follow steps 2-6 above to generate subsequent keypairs and have the CA returned
+Follow steps 2-6 above to generate subsequent keypairs and have the CA return
 signed certificates.
 
 Revoking certs and creating CRLs
@@ -93,7 +93,6 @@ RSA and EC private keys can be re-encrypted so a new passphrase can be supplied
 with one of the following commands depending on the key type:
 
         ./easyrsa set-rsa-pass EntityName
-
         ./easyrsa set-ec-pass EntityName
 
 Optionally, the passphrase can be removed completely with the 'nopass' flag.
diff --git a/build/build-dist.sh b/build/build-dist.sh
index 467963ca9..d1e098343 100755
--- a/build/build-dist.sh
+++ b/build/build-dist.sh
@@ -1,7 +1,8 @@
-#!/bin/bash
+#!/bin/sh
+# shellcheck disable=SC2162
 
 # Easy-RSA 3 distribution packager:
-# creates ready-to-use tarball files for Unixes
+# creates ready-to-use tarball files for Unixes and a zip file for windows
 
 # operational defaults (CLI processing overrides)
 VERSION="git-development"
@@ -11,21 +12,26 @@ SRC_ROOT="."
 BIN_DEST="."
 
 usage() {
-	echo "build-dist options:"
-	echo
-	echo " --version=X	set version string, default=git-development"
-	echo " --dist-root=X	set DIST_ROOT, default=dist-staging"
-	echo " --src-root=X	set SRC_ROOT for git src dir, default=."
-	echo " --bin-dest=X	set BIN_DEST where to put tar/zip, default=."
-	echo
-	echo " --dist-clean	rm -rf the DIST_ROOT w/out prompts"
+	cat << __EOF__
+build-dist options:
+
+ --version=X	set version string, default=git-development
+ --dist-root=X	set DIST_ROOT, default=dist-staging
+ --src-root=X	set SRC_ROOT for git src dir, default=.
+ --bin-dest=X	set BIN_DEST where to put tar/zip, default=.
+ --no-windows	do not build for Windows
+ --no-unix	do not build for UNIX
+ --no-compress  do not create zip/tar
+ --sign         Use GPG to sign and verify packages
+ --dist-clean	rm -rf the DIST_ROOT w/out prompts
+__EOF__
 
 	exit
 }
 
 die() {
-	echo "build-dist ERROR:"
-	echo "$1"
+	echo "build-dist ERROR:" >&2
+	echo "$1" >&2
 	exit "${2:-1}"
 }
 
@@ -33,9 +39,8 @@ note() { echo "build-dist NOTE: $1"; }
 
 # ask before dangerous things
 confirm() {
-	[ "$2" ] && return
-	echo "$1"
-	printf " y/n: "
+	[ -n "$2" ] && return
+	printf "%s y/n: " "$1"
 	read r
 	[ "$r" = "y" ] || die "user abort"
 }
@@ -45,9 +50,42 @@ main() {
 	PV="$PRODUCT-$VERSION"
 
 	dist_clean
-	stage_files
-	make_tar
-	make_zip
+	$SKIP_UNIX || stage_unix
+	$SKIP_WIN || stage_win
+	$SKIP_TAR || make_tar
+	$SKIP_ZIP || make_zip
+}
+
+# perform sign and verify
+sign_verify() {
+	# make sure gpg exists
+	gpgbin=$(which gpg)
+	if [ $? -ne 0 ];
+	then
+		echo "No gpg binary found in path."
+		return 1
+	fi
+
+	# $1 is our filename, it should exist
+	if [ -e "$1" ]; then
+		sign_out=$(gpg -qb "$1" 2>&1 )
+		# if signing worked, let's verify it
+		if [ $? -eq 0 ];
+		then
+			verify_out=$(gpg -q --verify "$1.sig" 2>&1 )
+			# if it's verified, return true
+			if [ $? -eq 0 ];
+			then
+				note "Sign and verify successful!"
+				return 0
+			fi
+		fi
+		# signing failed
+		note "Signing failed."
+		return 1
+	else
+		note "The file $1 doesn't exist or isn't readable."
+	fi
 }
 
 # prep DIST_ROOT
@@ -57,32 +95,102 @@ dist_clean() {
 			"$DISTCLEAN"
 		rm -rf "$DIST_ROOT" || die "dist_clean failed to rm"
 	fi
+	# remove any test pki paths in easyrsa path
+
+	if [ -d "easyrsa3/pki" ]; then
+		echo "Found test pki, removing..."       
+		rm -rf easyrsa3/pki
+	fi
 	mkdir -p "$DIST_ROOT" || die "dist_clean failed to mkdir"
 }
 
-# file stager
-stage_files() {
+# stage unix files
+stage_unix() {
+	# make our unix stage if it doesn't exist
+	mkdir -p "$DIST_ROOT/unix/$PV"
+
 	# Copy files into $PV, starting with easyrsa3 as the initial root dir
-	src_files="easyrsa3/ Licensing/ doc/ COPYING ChangeLog README.quickstart.md"
+	src_files="easyrsa3/. Licensing/. COPYING.md ChangeLog README.md README.quickstart.md doc"
 	for f in $src_files
 	do
-		cp -a "$SRC_ROOT/$f" "$DIST_ROOT/$PV" || die "failed to copy $f"
+		cp -R "$SRC_ROOT/$f" "$DIST_ROOT/unix/$PV/" || die "failed to copy $f"
 	done
 
+	# FreeBSD does not accept -i without argument in a way also acceptable by GNU sed
+	sed -i.tmp -e "s/~VER~/$VERSION/" \
+		   -e "s/~DATE~/$(date)/" \
+		   -e "s/~HOST~/$(hostname -s)/" \
+		   -e "s/~GITHEAD~/$(git rev-parse HEAD)/" \
+		   "$DIST_ROOT/unix/$PV/easyrsa" || die "Cannot update easyrsa version data"
+	rm -f "$DIST_ROOT/unix/$PV/easyrsa.tmp"
+
 	# files not included
-	rm -rf "$DIST_ROOT/$PV/doc/TODO" || die "failed rm TODO"
+	rm -rf "$DIST_ROOT/unix/$PV/doc/TODO" || die "failed rm TODO"
+}
+
+stage_win() {
+	for win in win32 win64;
+	do
+		# make our windows stage if it doesn't exist
+		mkdir -p "$DIST_ROOT/$win/$PV"
+
+		# make doc dir
+		mkdir -p "$DIST_ROOT/$win/$PV/doc"
+
+		for f in doc/*.md README.md README.quickstart.md COPYING.md;
+		do
+			# FreeBSD does not accept -i without argument in a way also acceptable by GNU sed
+			sed -i.tmp -e "s/~~~/$VERSION/" "$SRC_ROOT/$f" || die "Cannot update easyrsa version"
+			rm -f "$SRC_ROOT/$f.tmp"
+			python3 -m markdown "$SRC_ROOT/$f" > "$DIST_ROOT/$win/$PV/${f%.md}.html" || die "Failed to convert markdown to HTML"
+		done
+
+		# Copy files into $PV, starting with easyrsa3 as the initial root dir
+		src_files="easyrsa3/. ChangeLog COPYING.md Licensing distro/windows/Licensing distro/windows/bin distro/windows/$win/lib* distro/windows/$win/openssl.exe"
+		for f in $src_files
+		do
+			cp -R "$SRC_ROOT/$f" "$DIST_ROOT/$win/$PV/" || die "failed to copy $f"
+		done
+
+		src_files="README-Windows.txt EasyRSA-Start.bat"
+		for f in $src_files
+		do
+			cp -R "$SRC_ROOT/distro/windows/$f" "$DIST_ROOT/$win/$PV/" || die "failed to copy $f"
+			unix2dos "$DIST_ROOT/$win/$PV/$f" || die "unix2dos conversion failed for $f"
+		done
+
+		sed -i.tmp -e "s/~VER~/$VERSION/" \
+			   -e "s/~DATE~/$(date)/" \
+			   -e "s/~HOST~/$(hostname -s)/" \
+			   -e "s/~GITHEAD~/$(git rev-parse HEAD)/" \
+			   "$DIST_ROOT/$win/$PV/easyrsa" || die "Cannot update easyrsa version data"
+		rm -f "$DIST_ROOT/$win/$PV/easyrsa.tmp"
+
+		# files not included
+		rm -rf "$DIST_ROOT/$win/$PV/doc/TODO" || die "failed rm TODO"
+	done
 }
 
 make_tar() {
-	(cd "$DIST_ROOT"; tar cz "$PV") > "$BIN_DEST/${PV}.tgz" || die "tar failed"
-	note "tarball created at: $BIN_DEST/${PV}.tgz" 
+	(cd "$DIST_ROOT/unix/"; tar -czf "../${PV}.tgz" "$PV") || die "tar failed"
+	note "tarball created at: $DIST_ROOT/${PV}.tgz"
+	$SKIP_SIGN || sign_verify "$DIST_ROOT/${PV}.tgz"
 }
 
 make_zip() {
-	(cd "$DIST_ROOT"; zip -qr "../$BIN_DEST/${PV}.zip" "$PV") || die "zip failed"
-	note "zip file created at: $BIN_DEST/${PV}.zip" 
+	for win in win32 win64;
+	do
+		(cd "$DIST_ROOT/$win/"; zip -qr "../${PV}-$win.zip" "$PV") || die "zip failed"
+		note "zip file created at: $DIST_ROOT/${PV}-$win.zip"
+		$SKIP_SIGN || sign_verify "$DIST_ROOT/${PV}-$win.zip"
+	done
 }
 
+SKIP_WIN=false
+SKIP_UNIX=false
+SKIP_ZIP=false
+SKIP_TAR=false
+SKIP_SIGN=true
 # parse CLI options:
 while [ -n "$1" ]
 do
@@ -104,11 +212,27 @@ do
 			;;
 		--bin-dest)
 			[ -z "$val" ] && die "empty $cmd not allowed"
+			# shellcheck disable=SC2034
 			BIN_DEST="$val"
 			;;
+		--sign)
+			SKIP_SIGN=false
+			;;
 		--dist-clean)
 			DISTCLEAN=1
 			;;
+		--no-windows)
+			SKIP_WIN=true
+			SKIP_ZIP=true
+			;;
+		--no-unix)
+			SKIP_UNIX=true
+			SKIP_TAR=true
+			;;
+		--no-compress)
+			SKIP_ZIP=true
+			SKIP_TAR=true
+			;;
 		help|-h|--help|-help)
 			usage
 			;;
diff --git a/distro/README b/distro/README
index a74711fe9..a767be24c 100644
--- a/distro/README
+++ b/distro/README
@@ -2,4 +2,3 @@ This distro/ directory contains distro/platform specific tools.
 
 Components that are not platform neutral end up here, sorted into further dirs
 based on the platform.
-
diff --git a/distro/windows/EasyRSA Start.bat b/distro/windows/EasyRSA Start.bat
deleted file mode 100644
index 5bd117cdc..000000000
--- a/distro/windows/EasyRSA Start.bat	
+++ /dev/null
@@ -1,2 +0,0 @@
-@echo OFF
-bin\sh.exe bin\easyrsa-shell-init.sh
\ No newline at end of file
diff --git a/distro/windows/EasyRSA-Start.bat b/distro/windows/EasyRSA-Start.bat
new file mode 100644
index 000000000..8c28e862c
--- /dev/null
+++ b/distro/windows/EasyRSA-Start.bat
@@ -0,0 +1,2 @@
+@echo OFF
+bin\sh.exe bin\easyrsa-shell-init.sh %*
diff --git a/distro/windows/Licensing/LICENSE-OpenSSL.txt b/distro/windows/Licensing/LICENSE-OpenSSL.txt
new file mode 100644
index 000000000..053709229
--- /dev/null
+++ b/distro/windows/Licensing/LICENSE-OpenSSL.txt
@@ -0,0 +1,125 @@
+
+  LICENSE ISSUES
+  ==============
+
+  The OpenSSL toolkit stays under a double license, i.e. both the conditions of
+  the OpenSSL License and the original SSLeay license apply to the toolkit.
+  See below for the actual license texts.
+
+  OpenSSL License
+  ---------------
+
+/* ====================================================================
+ * Copyright (c) 1998-2018 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+ Original SSLeay License
+ -----------------------
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscape's SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are adhered to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the routines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publicly available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
diff --git a/distro/windows/Licensing/mksh-Win32.txt b/distro/windows/Licensing/mksh-Win32.txt
index f646763b6..533fa33e6 100644
--- a/distro/windows/Licensing/mksh-Win32.txt
+++ b/distro/windows/Licensing/mksh-Win32.txt
@@ -133,7 +133,7 @@ This icon may be used to refer to The MirBSD Korn Shell and
 its Win32 port. Distribution patches are acceptable as long
 as they modify $KSH_VERSION according to the guidelines that
 are published on the website; forks and works that are not
-derivates are not allowed to use it.
+derivatives are not allowed to use it.
 
 The BSD daemon is Copyright (c) 1988 by Marshall Kirk McKusick.
 All Rights Reserved.  Individuals may use the daemon for their
diff --git a/distro/windows/README-Windows.txt b/distro/windows/README-Windows.txt
index c118c18ff..4c3dfac16 100644
--- a/distro/windows/README-Windows.txt
+++ b/distro/windows/README-Windows.txt
@@ -3,8 +3,12 @@ Easy-RSA 3 Windows README
 Easy-RSA 3 runs POSIX shell code, so use on Windows has some additional
 requirements: an OpenSSL installation, and a usable shell environment.
 
-If you don't have OpenSSL, you'll need to install an OpenSSL package (see
-section 1.) The Easy-RSA Windows release includes a ready-to-use shell
+The Windows packages of EasyRSA 3.0.7+ include an OpenSSL binary and
+libraries that will be used by default.  If you want to use a system binary
+instead, remove the openssl.exe and the lib*.dll files from the bin
+directory.
+
+The Easy-RSA Windows release includes a ready-to-use shell
 environment with special thanks to the mksh/Win32 project.
 
 Contents of this file:
@@ -17,29 +21,7 @@ Contents of this file:
   5. Special Thanks
    5.1: mksh/Win32
 
-1. Obtaining OpenSSL for use with Easy-RSA
-
-   There are a couple of ways to do this:
-   
-  (A) If you are using OpenVPN, the easiest solution is to install the OpenSSL
-  program components and add openvpn to the system PATH; this is offered as an
-  installation option as part of OpenVPN.
-
-  (B) Optionally, install an OpenSSL package, such as from the openssl.org
-  website (see appendix.) In this case it will be required to do one of the
-  following:
-
-    (1) Add the location of openssl.exe to the system PATH
-
-    (2) Define the EASYRSA_OPENSSL env-var to reference the full path to
-    openssl.exe
-
-    (3) Edit the vars file (copy vars.example as a starting point) as instructed
-    in the comments
-
-    NOTE: for options 2 & 3 above, see section 3 below called "Windows Paths"
-
-2. Getting a POSIX shell
+1. Getting a POSIX shell
 
    The binary release of Easy-RSA 3 comes bundled with the mksh/Win32 shell
    environment and a handful of shell utility programs from the unxutils
@@ -66,7 +48,7 @@ Contents of this file:
        Provided this requirement is met, Cygwin can directly run the easyrsa
        script without any special interpreter or startup wrapper.
 
-3. Windows Paths
+2. Windows Paths
 
    The provided mksh/Win32 shell understands Windows paths. However, you MUST
    either:
@@ -83,9 +65,9 @@ Contents of this file:
    section 1 above) but applies to any other paths used in env-vars, the `vars`
    file, or in shell commands such as ls, cd, and so on.
 
-4. Appendix
+3. Appendix
 
- 4.1: Reference Links
+ 3.1: Reference Links
 
    * OpenSSL website:
      https://www.openssl.org
@@ -102,7 +84,7 @@ Contents of this file:
    * UnxUtils project:
      http://sourceforge.net/projects/unxutils
 
- 4.2: License of included components
+ 3.2: License of included components
 
       Text-format copies of these licenses are available in the Licensing/
       directory.
@@ -120,13 +102,13 @@ Contents of this file:
        The full source for this win32 port can be found here:
        http://sourceforge.net/projects/unxutils/
 
-5. Special Thanks
+4. Special Thanks
 
- 5.1: mksh/Win32
+ 4.1: mksh/Win32
 
     A special thanks is in order to the mksh/Win32 project and its primary
-    maintainer, Michael Langguth <mksh-w32@gmx.net>. This shell offers featurs
+    maintainer, Michael Langguth <mksh-w32@gmx.net>. This shell offers features
     that allow Easy-RSA to run smoothly under Windows; by using mksh/Win32,
     Easy-RSA can deliver the same PKI flexibility to all major platforms.
-       
+
 vim: wrap tw=80 expandtab
diff --git a/distro/windows/bin/awk.exe b/distro/windows/bin/awk.exe
new file mode 100755
index 000000000..aa1fada80
Binary files /dev/null and b/distro/windows/bin/awk.exe differ
diff --git a/distro/windows/bin/cat.exe b/distro/windows/bin/cat.exe
new file mode 100755
index 000000000..6a6af4dff
Binary files /dev/null and b/distro/windows/bin/cat.exe differ
diff --git a/distro/windows/bin/cp.exe b/distro/windows/bin/cp.exe
new file mode 100755
index 000000000..60f1cc2b6
Binary files /dev/null and b/distro/windows/bin/cp.exe differ
diff --git a/distro/windows/bin/date.exe b/distro/windows/bin/date.exe
new file mode 100755
index 000000000..069bae148
Binary files /dev/null and b/distro/windows/bin/date.exe differ
diff --git a/distro/windows/bin/diff.exe b/distro/windows/bin/diff.exe
new file mode 100755
index 000000000..2797ffd05
Binary files /dev/null and b/distro/windows/bin/diff.exe differ
diff --git a/distro/windows/bin/easyrsa-shell-init.sh b/distro/windows/bin/easyrsa-shell-init.sh
index 66568f6f9..f2f265deb 100644
--- a/distro/windows/bin/easyrsa-shell-init.sh
+++ b/distro/windows/bin/easyrsa-shell-init.sh
@@ -5,6 +5,101 @@
 # project; use with other POSIX shells for Windows may require modification to
 # this wrapper script.
 
+# SC2162 - read without -r will mangle backslashes
+# SC1091 - Not following source file
+# SC1003 - (info): Want to escape a single quote?
+# shellcheck disable=SC2162,SC1091,SC1003
+
+# intent confirmation helper func
+# modified from easyrsa
+confirm() {
+	prompt="$1"
+	value="$2"
+	msg="$3"
+	input=""
+	print "\
+$msg
+
+Type the word '$value' to continue, or any other input to abort."
+	printf %s "  $prompt"
+	# shellcheck disable=SC2162 # read without -r - confirm()
+	read input
+	printf '\n'
+	[ "$input" = "$value" ] && return
+	unset -v EASYRSA_SILENT
+	notice "Aborting without confirmation."
+	exit 1
+} # => confirm()
+
+# Access denied error
+access_denied() {
+		echo "Cannot locate or use a User-Home directory."
+		echo "Press [Enter] to exit."
+		read
+		exit 1
+} # => access_denied()
+
+# Administrator access Required tests
+admin_access() {
+	mkdir "$1" 2>/dev/null || return 1
+	[ -d "$1" ] || return 1
+	echo 1 >"$1"/1 2>/dev/null || return 1
+	[ -f "$1"/1 ] || return 1
+	rm -rf "$1" 2>/dev/null || return 1
+	[ ! -d "$1" ] || return 1
+} # => admin_access()
+
+# Setup "$HOMEDRIVE\$HOMEPATH\OpenVPN\easy-rsa" directory
+use_home_dir() {
+	if [ "$USERPROFILE" ]; then
+		# Use $USERPROFILE
+		user_home="$USERPROFILE"
+	elif [ "$HOMEDRIVE" ]; then
+		if [ "$HOMEPATH" ]; then
+			# Use $HOMEDRIVE and $HOMEPATH
+			user_home="${HOMEDRIVE}${HOMEPATH}"
+		else
+			user_home=
+		fi
+	else
+		user_home=
+	fi
+
+	# If no $user_home was identified
+	[ "$user_home" ] || access_denied
+
+	# Use $user_home/openvpn directory
+	cd "$user_home"/openvpn || access_denied
+
+	# Create $user_home/openvpn/easy-rsa directory
+	if [ ! -d easy-rsa ]; then
+		mkdir easy-rsa 2>/dev/null || access_denied
+		# Required test
+		[ -d easy-rsa ] || access_denied
+	fi
+
+	# Use $user_home/openvpn/easy-rsa directory
+	cd easy-rsa 2>/dev/null || access_denied
+
+	export HOME="$PWD"
+	export PATH="$HOME;$PATH"
+	unset -v user_home
+} # => use_home_dir()
+
+# set_var is defined as any vars file needs it.
+# This is the same as in easyrsa, but we _don't_ export
+set_var() {
+        var="$1"
+        shift
+        value="$*"
+        eval "$var=\"\${$var-$value}\""
+} #=> set_var()
+
+########################################
+# Invocation entry point:
+
+echo "Starting Easy-RSA shell.."
+
 setup_path="${EASYRSA:-$PWD}"
 export PATH="$setup_path;$setup_path/bin;$PATH"
 export HOME="$setup_path"
@@ -13,31 +108,41 @@ export HOME="$setup_path"
 # A user who runs mksh for other purposes might have it
 export ENV="/disable-env"
 
+# Check for broken administrator access
+# https://github.com/OpenVPN/easy-rsa/issues/1072
+if admin_access "$HOME"/easyrsa-write-test; then
+	sec_lev='#'
+else
+	echo "
+To use Easy-RSA in a protected system directory, you must have
+full administrator privileges via Windows User Access Control."
+
+	confirm "Continue without administrator access ? " yes "
+Easy-RSA will now try to use your User-Home directory."
+
+	use_home_dir
+	sec_lev='$'
+	echo "
+NOTICE:
+Easy-RSA has been auto-configured to run in your User-Home directory."
+fi
+
 # Verify required externals are present
-extern_list="which awk cat cp mkdir printf rm"
+extern_list="which awk cat cp mkdir printf rm grep sed"
 for f in $extern_list; do
 	if ! which "${f}.exe" >/dev/null 2>&1; then
 		echo ""
 		echo "FATAL: EasyRSA Shell init is missing a required external file:"
 		echo "  ${f}.exe"
-		echo "  Your installation is incomplete and cannot function without the required"
-		echo "  files."
+		echo "  Your installation is incomplete and cannot function without"
+		echo "  the required files."
 		echo ""
-		echo "  Press enter to exit."
-		read x
+		echo "Press Enter to exit."
+		read
 		exit 1
 	fi
 done
 
-# set_var is defined as any vars file needs it.
-# This is the same as in easyrsa, but we _don't_ export
-set_var() {
-        local var=$1
-        shift
-        local value="$*"
-        eval "$var=\"\${$var-$value}\""
-} #=> set_var()
-
 # Check for a usable openssl bin, referencing vars if present
 [ -r "vars" ] && EASYRSA_CALLER=1 . "vars" 2>/dev/null
 if [ -z "$EASYRSA_OPENSSL" ] && ! which openssl.exe >/dev/null 2>&1; then
@@ -48,18 +153,35 @@ fi
 
 [ -f "$setup_path/easyrsa" ] || {
 	echo "Missing easyrsa script. Expected to find it at: $setup_path/easyrsa"
-	exit 2
+	echo "Press Enter to exit."
+	read
+	exit 1
 }
 
+# Check for openvpn executable
+if which openvpn.exe >/dev/null 2>&1; then
+	EASYRSA_OPENVPN="$(which openvpn.exe | sed s/'\\'/'\/'/g)" || {
+		echo "verify_openvpn - Failed to convert openvpn path."
+		echo "Press Enter to exit."
+		read
+		exit 1
+	}
+	export EASYRSA_OPENVPN="$EASYRSA_OPENVPN"
+else
+	echo "WARNING: openvpn.exe is not in your system PATH."
+	echo "EasyRSA will not be able to generate OpenVPN TLS keys."
+fi
+
 # Set prompt and welcome message
-export PS1='
-EasyRSA Shell
-# '
+export PS1="$USERNAME@$COMPUTERNAME $HOME
+EasyRSA-Shell: $sec_lev "
+
 echo ""
 echo "Welcome to the EasyRSA 3 Shell for Windows."
 echo "Easy-RSA 3 is available under a GNU GPLv2 license."
 echo ""
-echo "Invoke './easyrsa' to call the program. Without commands, help is displayed."
+echo "Invoke 'easyrsa' to call the program. Without commands, help is displayed."
+echo ""
 
 # Drop to a shell and await input
-bin/sh
\ No newline at end of file
+sh.exe
diff --git a/distro/windows/bin/grep.exe b/distro/windows/bin/grep.exe
new file mode 100755
index 000000000..427f92fc5
Binary files /dev/null and b/distro/windows/bin/grep.exe differ
diff --git a/distro/windows/bin/ls.exe b/distro/windows/bin/ls.exe
new file mode 100755
index 000000000..388af5eb4
Binary files /dev/null and b/distro/windows/bin/ls.exe differ
diff --git a/distro/windows/bin/md5sum.exe b/distro/windows/bin/md5sum.exe
new file mode 100755
index 000000000..1640ba81f
Binary files /dev/null and b/distro/windows/bin/md5sum.exe differ
diff --git a/distro/windows/bin/mkdir.exe b/distro/windows/bin/mkdir.exe
new file mode 100755
index 000000000..83e57d97a
Binary files /dev/null and b/distro/windows/bin/mkdir.exe differ
diff --git a/distro/windows/bin/mv.exe b/distro/windows/bin/mv.exe
new file mode 100755
index 000000000..bcdc9d0e4
Binary files /dev/null and b/distro/windows/bin/mv.exe differ
diff --git a/distro/windows/bin/printf.exe b/distro/windows/bin/printf.exe
new file mode 100755
index 000000000..9060224bd
Binary files /dev/null and b/distro/windows/bin/printf.exe differ
diff --git a/distro/windows/bin/rm.exe b/distro/windows/bin/rm.exe
new file mode 100755
index 000000000..c489316c5
Binary files /dev/null and b/distro/windows/bin/rm.exe differ
diff --git a/distro/windows/bin/sed.exe b/distro/windows/bin/sed.exe
new file mode 100755
index 000000000..2a9f38c4d
Binary files /dev/null and b/distro/windows/bin/sed.exe differ
diff --git a/distro/windows/bin/sh.exe b/distro/windows/bin/sh.exe
new file mode 100755
index 000000000..a42d9962e
Binary files /dev/null and b/distro/windows/bin/sh.exe differ
diff --git a/distro/windows/bin/which.exe b/distro/windows/bin/which.exe
new file mode 100755
index 000000000..fbf68efc0
Binary files /dev/null and b/distro/windows/bin/which.exe differ
diff --git a/distro/windows/build/build_openssl.sh b/distro/windows/build/build_openssl.sh
new file mode 100755
index 000000000..9ba9748df
--- /dev/null
+++ b/distro/windows/build/build_openssl.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+#
+# This script clones, switches to a tag (CLI option)
+# then attempts to build openssl binaries
+
+# make a temporary working directory
+tempdir=$(mktemp -d)
+cd "$tempdir" || exit 1
+
+# clone repo
+git clone https://github.com/openssl/openssl.git && cd openssl
+
+# check out the tag from the CLI, if nothing passed, find latest
+latest=$(git tag --sort=committerdate --list 'openssl-3.*' | tail -1)
+
+# checkout that tag
+git checkout "tags/$latest"
+
+# crosscompile Windows 32
+./Configure --cross-compile-prefix=i686-w64-mingw32- mingw
+make
+
+# build done, save what we want
+mkdir "$tempdir/win32/"
+cp libcrypto-3.dll libssl-3.dll apps/openssl.exe "$tempdir/win32"
+
+# clean our source tree
+make clean
+
+# build 64-bit version
+./Configure --cross-compile-prefix=x86_64-w64-mingw32- mingw64
+make
+
+# build done, save what we want
+mkdir "$tempdir/win64/"
+cp libcrypto-3-x64.dll libssl-3-x64.dll apps/openssl.exe "$tempdir/win64"
+
+# we're done, make the zip file
+cd "$tempdir"
+zip "$latest.zip" win32/* win64/* && cp "$latest.zip" ~/
+
+# remove temp dir
+cd /tmp/
+rm -rf "$tempdir"
diff --git a/distro/windows/win32/libcrypto-3.dll b/distro/windows/win32/libcrypto-3.dll
new file mode 100755
index 000000000..ff4df3d39
Binary files /dev/null and b/distro/windows/win32/libcrypto-3.dll differ
diff --git a/distro/windows/win32/libssl-3.dll b/distro/windows/win32/libssl-3.dll
new file mode 100755
index 000000000..a5db50532
Binary files /dev/null and b/distro/windows/win32/libssl-3.dll differ
diff --git a/distro/windows/win32/openssl.exe b/distro/windows/win32/openssl.exe
new file mode 100755
index 000000000..acb32fffb
Binary files /dev/null and b/distro/windows/win32/openssl.exe differ
diff --git a/distro/windows/win64/libcrypto-3-x64.dll b/distro/windows/win64/libcrypto-3-x64.dll
new file mode 100755
index 000000000..5f374adf8
Binary files /dev/null and b/distro/windows/win64/libcrypto-3-x64.dll differ
diff --git a/distro/windows/win64/libssl-3-x64.dll b/distro/windows/win64/libssl-3-x64.dll
new file mode 100755
index 000000000..a196e2200
Binary files /dev/null and b/distro/windows/win64/libssl-3-x64.dll differ
diff --git a/distro/windows/win64/openssl.exe b/distro/windows/win64/openssl.exe
new file mode 100755
index 000000000..b55b6d560
Binary files /dev/null and b/distro/windows/win64/openssl.exe differ
diff --git a/doc/EasyRSA-Advanced.md b/doc/EasyRSA-Advanced.md
index 64069469f..1c9112508 100644
--- a/doc/EasyRSA-Advanced.md
+++ b/doc/EasyRSA-Advanced.md
@@ -13,7 +13,7 @@ Configuration Reference
   There are 3 possible ways to perform external configuration of Easy-RSA,
   selected in the following order where the first defined result wins:
 
-  1. Commmand-line option
+  1. Command-line option
   2. Environmental variable
   3. 'vars' file, if one is present (see `vars Autodetection` below)
   4. Built-in default
@@ -31,15 +31,29 @@ Configuration Reference
   The following locations are checked, in this order, for a vars file. Only the
   first one found is used:
 
-  1. File referenced by the --vars CLI option
+  1. The file referenced by the `--vars` CLI option
   2. The file referenced by the env-var named `EASYRSA_VARS_FILE`
-  3. The `EASYRSA_PKI` directory
-  4. The `EASYRSA` directory
-  5. The location of the easyrsa program (usually will be the same as above)
+  3. The directory referenced by the `--pki` CLI option (Recommended)
+  4. The directory referenced by the `EASYRSA_PKI` env-var
+  5. The directory referenced by the `EASYRSA` env-var
+  6. The default PKI directory at `$PWD/pki` (See note below)
+  7. The default working directory at `$PWD`
 
   Defining the env-var `EASYRSA_NO_VARS` will override the sourcing of the vars
   file in all cases, including defining it subsequently as a global option.
 
+  Note: If the vars file `$PWD/pki/vars` is sourced then it is forbidden from
+        setting/changing the current PKI, as defined by `EASYRSA_PKI` env-var.
+
+#### Use of `--pki` verses `--vars`
+
+  It is recommended to use option `--pki=DIR` to define your PKI at runtime.
+  This method will always auto-load the `vars` file found in the defined PKI.
+
+  In a multi-PKI installation, use of `--vars` can potentially lead to
+  a vars file that is configured to set a PKI which cannot be verified
+  as the expected PKI. Use of `--vars` is not recommended.
+
 #### OpenSSL Config
 
   Easy-RSA is tightly coupled to the OpenSSL config file (.cnf) for the
@@ -51,8 +65,8 @@ Configuration Reference
 
   1. The env-var `EASYRSA_SSL_CONF`
   2. The 'vars' file (see `vars Autodetection` above)
-  3. The `EASYRSA_PKI` directory with a filename of `openssl-1.0.cnf`
-  4. The `EASYRSA` directory with a filename of `openssl-1.0.cnf`
+  3. The `EASYRSA_PKI` directory with a filename of `openssl-easyrsa.cnf`
+  4. The `EASYRSA` directory with a filename of `openssl-easyrsa.cnf`
 
 Advanced extension handling
 ---------------------------
@@ -71,16 +85,48 @@ Additionally, the contents of the env-var `EASYRSA_EXTRA_EXTS` is appended with
 its raw text added to the OpenSSL extensions. The contents are appended as-is to
 the cert extensions; invalid OpenSSL configs will usually result in failure.
 
+Advanced configuration files
+----------------------------
+
+The following files are used by Easy-RSA to configure the SSL library:
+* openssl-easyrsa.cnf - Configuration for Certificate Authority [CA]
+* x509-types: COMMON, ca, server, serverClient, client, codeSigning, email.
+  Each type is used to define an X509 purpose.
+
+Since Easy-RSA version 3.2.0, these files are created on-demand by each command
+that requires them.  However, if these files are found in one of the supported
+locations then those files are used instead, they are copied to temporary files.
+X509-type 'kdc' is only supported as an external file.
+
+The supported locations are listed, in order of preference, as follows:
+* `EASYRSA_PKI` - Always preferred.
+* `EASYRSA` - For Windows.
+* `PWD` - For Windows.
+* `easyrsa` script directory - DEPRECATED, will be removed. Only for Windows.
+* `/usr/local/share/easy-rsa`
+* `/usr/share/easy-rsa`
+* `/etc/easy-rsa`
+
+The x509-type files can be created by using command: `easyrsa write legacy`.
+To OVER-WRITE any existing files use command: `eaysrsa write legacy-hard`.
+This will create the files in the current PKI.  If created then these new
+files take priority over system wide versions of the same files.
+
+
+
 Environmental Variables Reference
 ---------------------------------
 
 A list of env-vars, any matching global option (CLI) to set/override it, and a
-possible terse description is shown below:
+short description is shown below:
 
- *  `EASYRSA` - should point to the Easy-RSA top-level dir, normally $PWD
+ *  `EASYRSA` - should point to the Easy-RSA top-level dir, where the easyrsa
+    script is located.
  *  `EASYRSA_OPENSSL` - command to invoke openssl
  *  `EASYRSA_SSL_CONF` - the openssl config file to use
- *  `EASYRSA_PKI` (CLI: `--pki-dir`) - dir to use to hold all PKI-specific files
+ *  `EASYRSA_PKI` (CLI: `--pki`) - dir to use to hold all PKI-specific files,
+     defaults to `$PWD/pki`.
+ *  `EASYRSA_VARS_FILE` (CLI: `--vars`) - Set the `vars` file to use
  *  `EASYRSA_DN` (CLI: `--dn-mode`) - set to the string `cn_only` or `org` to
     alter the fields to include in the req DN
  *  `EASYRSA_REQ_COUNTRY` (CLI: `--req-c`) - set the DN country with org mode
@@ -92,23 +138,51 @@ possible terse description is shown below:
  *  `EASYRSA_REQ_EMAIL` (CLI: `--req-email`) - set the DN email with org mode
  *  `EASYRSA_REQ_OU` (CLI: `--req-ou`) - set the DN organizational unit with org
     mode
- *  `EASYRSA_KEY_SIZE` (CLI: `--key-size`) - set the keysize in bits to generate
- *  `EASYRSA_ALGO` (CLI: `--use-algo`) - set the crypto alg to use: rsa or ec
+ *  `EASYRSA_REQ_SERIAL` (CLI: `--req-serial`) - set the DN serialNumber with
+    org mode (OID 2.5.4.5)
+ *  `EASYRSA_AUTO_SAN` (CLI: `--auto-san`) - use CN for SAN
+ *  `EASYRSA_SAN` (CLI: `--san`) - Set subjectAltName for certificate
+ *  `EASYRSA_SAN_CRIT` (CLI: `--san-crit`) - set the certificate SAN as 'critical'
+ *  `EASYRSA_BC_CRIT` (CLI: `--bc-crit`) - set the certificate BC as 'critical'
+ *  `EASYRSA_KU_CRIT` (CLI: `--ku-crit`) - set the certificate KU as 'critical'
+ *  `EASYRSA_EKU_CRIT` (CLI: `--eku-crit`) - set the certificate EKU as 'critical'
+ *  `EASYRSA_EXTRA_EXTS` - user defined extensions to add to the request or cert
+ *  `EASYRSA_CP_EXT` (CLI: `--copy-ext`) - copy extensions from request to cert
+ *  `EASYRSA_KEY_SIZE` (CLI: `--keysize`) - set the key size in bits to generate
+ *  `EASYRSA_ALGO` (CLI: `--use-algo`) - set the crypto alg to use: rsa, ec or ed
  *  `EASYRSA_CURVE` (CLI: `--curve`) - define the named EC curve to use
- *  `EASYRSA_EC_DIR` - dir to store generated ecparams
  *  `EASYRSA_CA_EXPIRE` (CLI: `--days`) - set the CA expiration time in days
- *  `EASYRSA_CERT_EXPIRE` (CLI: `--days`) - set the issued cert expiration time
-    in days
+ *  `EASYRSA_CERT_EXPIRE` (CLI: `--days`) - set the cert expiration time in days
  *  `EASYRSA_CRL_DAYS` (CLI: `--days`) - set the CRL 'next publish' time in days
  *  `EASYRSA_NS_SUPPORT` (CLI: `--ns-cert`) - string 'yes' or 'no' fields to
-    include the deprecated Netscape extensions
+    include the **deprecated** Netscape extensions
  *  `EASYRSA_NS_COMMENT` (CLI: `--ns-comment`) - string comment to include when
-    using the deprecated Netscape extensions
- *  `EASYRSA_TEMP_FILE` - a temp file to use when dynamically creating req/cert
-    extensions
- *  `EASYRSA_REQ_CN` (CLI: `--req-cn`) - default CN, necessary to set in BATCH
+    using the **deprecated** Netscape extensions
+ *  `EASYRSA_REQ_CN` (CLI: `--req-cn`) - default CN, can only be used in BATCH
     mode
- *  `EASYRSA_DIGEST` (CLI: `--digest`) - set a hash diget to use for req/cert
+ *  `EASYRSA_DIGEST` (CLI: `--digest`) - set a hash digest to use for req/cert
     signing
  *  `EASYRSA_BATCH` (CLI: `--batch`) - enable batch (no-prompt) mode; set
     env-var to non-zero string to enable (CLI takes no options)
+ *  `EASYRSA_VERBOSE` (CLI: `-v`) - Enable verbose output
+ *  `EASYRSA_PASSIN` (CLI: `--passin`) - allows to specify a source for
+    password using any openssl password options like pass:1234 or env:var
+ *  `EASYRSA_PASSOUT` (CLI: `--passout`) - allows to specify a source for
+    password using any openssl password options like pass:1234 or env:var
+ *  `EASYRSA_NO_PASS` (CLI: `--nopass`) - disable use of passwords
+ *  `EASYRSA_UMASK` (CLI: `--umask`) - safe umask to use for file creation
+    Defaults to `077`
+ *  `EASYRSA_NO_UMASK` (CLI: `--no-umask`) - disable safe umask. Files will be
+    created using the system's default
+ *  `EASYRSA_TEMP_DIR` (CLI: `--tmp-dir`) - an existing directory to use for
+    temporary files
+ *  `EASYRSA_NO_INLINE` (CLI: `--no-inline`) - disable creation of inline files
+ *  `EASYRSA_TEXT_ON` (CLI: `--text`) - include human readable text in SSL output
+ *  `EASYRSA_TEXT_OFF` (CLI: `--notext`) - exclude human readable text from SSL
+    output
+ *  `EASYRSA_FORCE_SAFE_SSL` (CLI: `--force-safe-ssl`) - expand environment
+    variables in SSL config
+ *  `EASYRSA_FORCE_VARS` (CLI: `--force-vars`) - ignore known errors in 'vars' file
+ *  `EASYRSA_SET_ERREXIT` - Enable `errexit`, IE. `set -e`, within `easyrsa` script
+
+**NOTE:** the global options must be provided before the commands.
diff --git a/doc/EasyRSA-Contributing.md b/doc/EasyRSA-Contributing.md
new file mode 100644
index 000000000..23c6d6c04
--- /dev/null
+++ b/doc/EasyRSA-Contributing.md
@@ -0,0 +1,139 @@
+Easy-RSA 3 GitHub Contributions Documentation
+=============================================
+
+This document explains how to contribute to Easy-RSA 3.
+
+Please follow these simple steps and make contributing easier.
+
+Intended audience: Everyone.
+
+Contributing Guide
+------------------
+
+-   **Do not** edit Easy-RSA `master` branch.
+
+-   **Do not** edit Easy-RSA `master` branch.
+
+    Pull Requests submitted from `master` branch may be squashed or rejected.
+
+### Create a new branch:
+
+-   Select a suitable name for the new branch. eg: `doc-contrib-typo`
+
+    ```
+    git checkout -b doc-contrib-typo
+    ```
+
+-   Make changes to the new branch.
+
+    Please use tabs to indent the code but only use tabs at the beginning of
+    the line.
+
+-   Review the changes:
+
+    ```
+    git diff
+    ```
+
+-   Stage the changes:
+
+    ```
+    git add -A
+    ```
+
+-   Show the extent of the changes:
+
+    ```
+    git status -v
+    ```
+
+-   Commit the changes:
+
+    ```
+    git commit -sS
+    ```
+
+    Please write a detailed commit message.
+
+    github `help` has details of creating a private key.
+
+    Using github `no-reply` email address is suitable for the `Signed-off-by:`
+    line.
+
+-   Push the changes:
+
+    ```
+    git push origin doc-contrib-typo
+    ```
+
+-   Share the changes:
+
+    ```
+    Raise a Pull Request on github.
+    ```
+
+Keeping your fork synchronised
+-----------------------------
+
+-   Configure the `upstream` remote for your fork:
+
+    ```
+    git remote add upstream https://github.com/OpenVPN/easy-rsa.git
+    ```
+
+-   Verify the remote sources:
+
+    ```
+    git remote -v
+    ```
+
+    Remote `origin` will have **your** repository:
+
+    ```
+    origin https://github.com/TinCanTech/easy-rsa.git (fetch)
+    origin https://github.com/TinCanTech/easy-rsa.git (push)
+    ```
+
+    Remote `upstream` will be `Openvpn/easy-rsa`:
+
+    ```
+    upstream https://github.com/Openvpn/easy-rsa.git (fetch)
+    upstream https://github.com/Openvpn/easy-rsa.git (push)
+    ```
+
+### Synchronising your fork:
+
+-   Select `master` branch:
+
+    ```
+    git checkout master
+    ```
+
+-   Fetch changes in `upstream`:
+
+    ```
+    git fetch upstream
+    ```
+
+-   Merge changes in `upstream`:
+
+    ```
+    git merge upstream/master
+    ```
+
+-   Update your fork on github:
+
+    ```
+    git push
+    ```
+
+
+    Your fork is now synchronised.
+
+### Notes:
+
+-   Use SSL for Github:
+
+    ```
+    git config --global url.ssh://git@github.com/.insteadOf https://github.com/
+    ```
diff --git a/doc/EasyRSA-Readme.md b/doc/EasyRSA-Readme.md
index 568c3a66a..a86c32a10 100644
--- a/doc/EasyRSA-Readme.md
+++ b/doc/EasyRSA-Readme.md
@@ -4,7 +4,7 @@ Easy-RSA 3 Documentation Readme
 This document explains how Easy-RSA 3 and each of its assorted features work.
 
 If you are looking for a quickstart with less background or detail, an
-implementation-specific Howto or Readme may be available in this (the `doc/`)
+implementation-specific How-to or Readme may be available in this (the [`doc/`](./))
 directory.
 
 Easy-RSA Overview
@@ -12,7 +12,7 @@ Easy-RSA Overview
 
 Easy-RSA is a utility for managing X.509 PKI, or Public Key Infrastructure. A
 PKI is based on the notion of trusting a particular authority to authenticate a
-remote peer; for more background on how PKI works, see the `Intro-To-PKI`
+remote peer; for more background on how PKI works, see the [Intro-To-PKI](Intro-To-PKI.md)
 document.
 
 The code is written in platform-neutral POSIX shell, allowing use on a wide
@@ -74,7 +74,7 @@ Obtaining and Using Easy-RSA
   General usage and command help can be shown with:
 
     ./easyrsa help [ command ]
-  
+
   When run without any command, general usage and a list of available commands
   are shown; when a command is supplied, detailed help output for that command
   is shown.
@@ -97,15 +97,14 @@ Any of these options can appear before the command as required as shown below:
 
     ./easyrsa [options] command [ cmd-opts ]
 
-For experts, additional configuration flexibility is available by way of
-env-vars and custom X.509 extensions. Consult the `EasyRSA-Advanced`
-documentation for details
+For experts, additional configuration with env-vars and custom X.509 extensions
+is possible. Consult the [EasyRSA-Advanced](EasyRSA-Advanced.md) documentation for details.
 
 Getting Started: The Basics
 ---------------------------
 
 Some of the terms used here will be common to those familiar with how PKI works.
-Instead of describing PKI basics, please consult the document `Intro-To-PKI` if
+Instead of describing PKI basics, please consult the document [Intro-To-PKI](Intro-To-PKI.md) if
 you need a more basic description of how a PKI works.
 
 #### Creating an Easy-RSA PKI
@@ -126,16 +125,16 @@ you need a more basic description of how a PKI works.
 
   An Easy-RSA PKI contains the following directory structure:
 
-  * private/ - dir with private keys generated on this host
-  * reqs/ - dir with locally generated certificate requests (for a CA imported
+  * `private/` - dir with private keys generated on this host
+  * `reqs/` - dir with locally generated certificate requests (for a CA imported
     requests are stored here)
 
-  In a clean PKI no files will exist until, just the bare directories. Commands
-  called later will create the necessary files depending on the operation.
+  In a clean PKI no files exist yet, just the bare directories. Commands called
+  later will create the necessary files depending on the operation.
 
   When building a CA, a number of new files are created by a combination of
   Easy-RSA and (indirectly) openssl. The important CA files are:
-  
+
   * `ca.crt` - This is the CA certificate
   * `index.txt` - This is the "master database" of all issued certs
   * `serial` - Stores the next serial number (serial numbers increment)
@@ -155,7 +154,7 @@ Using Easy-RSA as a CA
 #### Building the CA
 
   In order to sign requests to produce certificates, you need a CA. To create a
-  new CA in a PKI you have created, run:
+  new CA in the PKI you have created, run:
 
     ./easyrsa build-ca
 
@@ -184,19 +183,24 @@ Using Easy-RSA as a CA
 
 #### Signing a request
 
-  Once Easy-RSA has imported a request, it can be reviewed and signed. Every
-  certificate needs a "type" which controls what extensions the certificate gets
-  Easy-RSA ships with 3 possible types: `client`, `server`, and `ca`, described
-  below:
+  Once Easy-RSA has imported a request, it can be reviewed and signed:
+
+    ./easyrsa sign-req <type> nameOfRequest
 
-  * client - A TLS client, suitable for a VPN user or web browser (web client)
-  * server - A TLS server, suitable for a VPN or web server
-  * ca - A subordinate CA, used when chaining multiple CAs together
+  Every certificate needs a `type` which controls what extensions the certificate
+  gets.
+
+  Easy-RSA ships with 4 possible "types":
+
+  * `client` - A TLS client, suitable for a VPN user or web browser (web client)
+  * `server` - A TLS server, suitable for a VPN or web server
+  * `ca` - A intermediate CA, used when chaining multiple CAs together
+  * `serverClient` - A TLS server and TLS client
 
   Additional types of certs may be defined by local sites as needed; see the
   advanced documentation for details.
 
-#### Revoking and publishing CRLs
+#### Revoking and publishing Certificate Revocation Lists (CRLs)
 
   If an issue certificate needs to be revoked, this can be done as follows:
 
@@ -207,7 +211,7 @@ Using Easy-RSA as a CA
     ./easyrsa gen-crl
 
   Note that this will need to be published or sent to systems that rely on an
-  up-to-date CRL as the certificate is still otherwise valid.
+  up-to-date CRL as the certificate is still valid otherwise.
 
 Using Easy-RSA to generate keypairs & requests
 ----------------------------------------------
@@ -224,7 +228,7 @@ Easy-RSA can generate a keypair and request with the following command:
     ./easyrsa gen-req nameOfRequest
 
 You will then be given a chance to modify the Subject details of your request.
-By default Easy-RSA uses the short name supplied on the command-line, though you
+Easy-RSA uses the short name supplied on the command-line by default, though you
 are free to change it if necessary. After providing a passphrase and Subject
 details, the keypair and request files will be shown.
 
@@ -232,4 +236,3 @@ In order to obtain a signed certificate, the request file must be sent to the
 CA for signing; this step is obviously not required if a single PKI is used as
 both the CA and keypair/request generation as the generated request is already
 "imported."
-
diff --git a/doc/EasyRSA-Renew-and-Revoke.md b/doc/EasyRSA-Renew-and-Revoke.md
new file mode 100644
index 000000000..b48cf2766
--- /dev/null
+++ b/doc/EasyRSA-Renew-and-Revoke.md
@@ -0,0 +1,267 @@
+Easy-RSA 3 Certificate Renewal and Revocation Documentation
+===========================================================
+
+This document explains how the **differing versions** of Easy-RSA 3 work
+with regard to Renewal and Revocation of Certificates.
+
+## In summary:
+
+**Easy-RSA Version 3.1.7** provides the most flexible support of renewal.
+This includes command `rewind-renew`, which is required to recover certificates
+renewed by `renew` command version 1. However, this does **not** include renewing
+any supported certificate attributes.
+
+**Easy-RSA Version 3.2.1** is preferred for future support.
+
+----
+
+Reason codes available for revoke commands
+------------------------------------------
+
+The follow is an exhaustive list of available `reason` codes, with abbreviations:
+
+- `us | uns* | unspecified`
+- `kc | key* | keyCompromise`
+- `cc | ca*  | CACompromise`
+- `ac | aff* | affiliationChanged`
+- `ss | sup* | superseded`
+- `co | ces* | cessationOfOperation`
+- `ch | cer* | certificateHold`
+
+  `reason` must be one of these abbreviations/codes, otherwise not be used.
+
+----
+
+Easy-RSA version 3.2.x
+======================
+For **Easy-RSA Version 3.2.0**, command `renew` is NOT supported.
+
+Please upgrade to Easy-RSA Version 3.2.1
+
+For **Easy-RSA Version 3.2.1+**, command `renew` is supported.
+
+The command `renew` has been rewritten and now supports the renewal of
+supported attributes. During renewal, the certificate is inspected and all
+supported attributes are applied to the renewed certificate, as they were
+in the original.
+
+User added attributes from `$EASYRSA_EXTRA_EXTS`, that are not supported,
+are dropped.
+
+If the renewed certificate requires unsupported attibutes or changing the
+`commonName` then the following process, that of expiry and then signing a
+new certificate from the original request file, is required.
+
+The expiry and signing process is as follows:
+1. Command `expire <NAME>`
+
+   This will move an existing certificate from `pki/issued` to `pki/expired`,
+   so that a new certificate can be signed, using the original request.
+
+   Generally, renewing is required ONLY when a certificate is due to expire.
+   This means that certificates moved to `pki/expired` are expected to be expired
+   or to expire in the near future, however, this is not a requirement.
+
+2. Command `sign-req <TYPE> <NAME>`
+
+   Sign a new certificate. This allows ALL command line customisations to be used.
+
+3. If required, command `revoke-expired` can be used to revoke an
+   expired certificate in the `pki/expired` directory.
+
+This approach allows original certificates, which have been edited during `sign-req`,
+to be edited the same way.
+
+----
+
+Easy-RSA version 3.1.x
+======================
+
+Command Details: `renew`
+------------------------
+
+    easyrsa renew file-name-base [ cmd-opts ]
+
+`renew` is **only** available since Easy-RSA version `3.0.6`
+
+#### `renew` has three different versions:
+
+ *  `renew` **Version 1**: Easy-RSA versions `3.0.6`, `3.0.7` and `3.0.8`.
+    - Both certificate and private key are rebuilt.
+    - Once a certificate has been renewed it **cannot** be revoked.
+
+ *  `renew` **Version 2**: Easy-RSA versions `3.0.9` and `3.1.0`.
+    - Both certificate and private key are rebuilt.
+    - Once a certificate has been renewed it **can** be revoked.
+    - Use command:
+
+        `revoke-renewed file-name-base [ reason ]`
+
+ *  `renew` **Version 3**: Easy-RSA versions `3.1.1` through `3.1.7`.
+    - Only certificate is renewed.
+    - The original `renew` command has been renamed to `rebuild`, which
+      rebuilds both certificate and private key.
+
+ *  `renew` **Version 4**: Easy-RSA version `3.2.0+`.
+    - Only certificate is renewed.
+    - Supports standard Easy-RSA X509 extension duplication.
+
+
+Resolving issues with `renew` version 1
+---------------------------------------
+
+#### Upgrade Easy-RSA to version `3.1.1+` is required.
+
+`renew` version 1 **rebuilds** the certificate and private key.
+
+Once a certificate has been renewed by version 1, the files are saved in the
+`renewed/` storage area by `serialNumber`. These files must be recovered by
+using command:
+
+    easyrsa rewind-renew serialNumber
+
+Command `rewind-renew` is only available in Easy-RSA version `3.1.1` to `3.1.7`.
+
+Once `rewind-renew` has recovered the files, the certificate can be revoked:
+
+    easyrsa revoke-renewed file-name-base [ reason ]
+
+
+Using `renew` version 2
+-----------------------
+
+#### Upgrade Easy-RSA to version `3.1.1+` is required.
+
+`renew` version 2 **rebuilds** the certificate and private key.
+
+Renewed certificate can be revoked:
+
+    easyrsa revoke-renewed file-name-base [ reason ]
+
+
+Using `renew` version 3
+-----------------------
+
+#### Upgrade Easy-RSA to version `3.1.1+` is required.
+
+`renew` version 3 **renews** the certificate only.
+
+Renewed certificate can be revoked:
+
+    easyrsa revoke-renewed file-name-base [ reason ]
+
+This is the preferred method to renew a certificate because the original
+private key is still valid.
+
+Using `renew` version 4
+-----------------------
+
+#### Upgrade Easy-RSA to version `3.2.0+` is required.
+
+This is the most comprensive version of `renew`, which supports automatic
+copying of Easy-RSA X509 extensions.
+
+
+----
+
+Easy-RSA Reporting tools for certificate status
+-----------------------------------------------
+
+Easy-RSA version `3.1.x`, also has the following tools to keep track of
+certificate status:
+
+    easyrsa [ --days=# ] show-expire [ file-name-base ]
+
+  `show-expire` shows all certificates which will expire in given `--days`.
+
+    easyrsa show-renew [ file-name-base ]
+
+  `show-renew` shows all certificates which have been renewed, where the old
+  certificate has not been revoked.
+
+    easyrsa show-revoke [ file-name-base ]
+
+  `show-revoke` shows all certificates which have been revoked.
+
+----
+
+About command `rebuild`
+-----------------------
+
+If `rebuild` is used then the output directory of old certificate, key and
+request is also the `renewed` directory.  Use **`revoke-renewed`** to revoke
+an old certificate/key pair, which has been _rebuilt_ by command `rebuild`.
+
+----
+
+Renew CA Certificate
+====================
+
+Easy-RSA Version `3.2.2+ includes command `renew-ca`, which will create a new
+CA certificate using the original CA key.  This new certificate will completely
+replace the previous CA certificate.  This command can be safely tested without
+disturbing your current PKI. The command requires user confirmation before
+installing the new CA certificate.  The old CA certificate is archived to the
+file 'pki/expired-ca.list'.
+
+
+Easy-RSA Version `3.2.1+` supports a simple way to effectively renew a CA Certificate.
+
+**Preamble** - Specifically for use with OpenVPN:
+
+When a CA certificate expires it must be replaced, this is unavoidable.
+No matter what method is used to create a new or renewed CA certificate,
+that CA certificate must be distributed to all of your servers and clients.
+
+Please consider the method outlined here, which requires very little work:
+
+1. **Before you do anything else -- Make a BACKUP of your current PKI.**
+
+2. Use command `init-pki soft`
+
+   This will reset your current PKI but will keep your `vars` setting file
+   and your current Request files [CSR], in the `pki/reqs` directory.
+
+   If you have an Easy-RSA generated TLS key for OpenVPN, that will also be
+   preserved. However, it will NOT be used for new `inline` files. The file
+   `pki/private/easyrsa-tls.key` will be moved to `pki/easyrsa-keepsafe-tls.key`,
+   for safe keeping. Easy-RSA will display a warning that this key is still
+   valid and possibly in use, before allowing another TLS key to be generated.
+
+3. Use command `build-ca`
+
+   (With or without password and other preferences)
+
+   This will build a completely new CA Certificate and private key.
+
+   Use option `--days` to extend the lifetime of your new CA.
+
+4. Use command `sign-req <TYPE> <NAME>`
+
+   (With or without other preferences, password is not relevant)
+
+   This will use an existing Request to sign a new Certificate.
+
+   This will NOT generate a new Private Key for each new Certificate.
+
+   This will generate new `inline` files that can be distributed publicly.
+   These `inline` files will not contain any security sensitive data.
+
+   This means that you will have a new CA certificate and private key.
+   And signed certificates for all of your users, including servers.
+
+5. Distribute the new `inline` files to all members of your PKI/VPN.
+
+   These new `inline` files will not contain the user private key or the
+   OpenVPN Pre-shared TLS key.
+
+   These new `inline` files can be used by OpenVPN, examples below:
+
+   * specify: `--config <INLNE-FILE>` in the OpenVPN user config file.
+   * Use copy/paste to add the new details to the OpenVPN user config file.
+   * Use `cat` to append the `inline` file to the OpenVPN user config file.
+
+   Note:
+   `inline` files in the `pki/inline/private` directory include security keys,
+   which MUST only be transmitted over a secure connection, such as `https`.
+
diff --git a/doc/EasyRSA-Upgrade-Notes.md b/doc/EasyRSA-Upgrade-Notes.md
index f5c151454..b772fc21d 100644
--- a/doc/EasyRSA-Upgrade-Notes.md
+++ b/doc/EasyRSA-Upgrade-Notes.md
@@ -5,6 +5,10 @@ People upgrading to Easy-RSA 3 from a 2.x version should note some important
 changes starting with version 3. For a better overview of version 3 in general,
 see the Readme in the doc/ directory.
 
+Easy-RSA 3 comes with an automated upgrade utility to convert an existing 2.x
+PKI to version 3. For details, see [this article on the OpenVPN
+wiki](https://community.openvpn.net/openvpn/wiki/easyrsa-upgrade).
+
 List of important changes
 ----
 
@@ -54,5 +58,5 @@ Easy-RSA 3 has some new concepts compared to the prior v2 series.
   generation as the requester doesn't need to know the CA's values in advance.
 
   Previously in v2, the Country, State, and Org values all had to match or a
-  request couldn't be signed. If you want the old behavior your can change the
+  request couldn't be signed. If you want the old behavior you can change the
   OpenSSL config to require it or simply look over the DN at signing time.
diff --git a/doc/Hacking.md b/doc/Hacking.md
index d1b7f6ad7..9a5996d98 100644
--- a/doc/Hacking.md
+++ b/doc/Hacking.md
@@ -108,7 +108,7 @@ messages and merge actions.
 
   Contributions can come in many forms: GitHub "pull requests" from cloned
   repos, references to external repos, patches to the ML, or others. Those won't
-  necessary have `Signed-off-by:` lines or may contain less info in the commit
+  necessarily have `Signed-off-by:` lines or may contain less info in the commit
   message than is desirable to explain the changes.
 
   The committing author to this project should make a merge-commit in this case
diff --git a/doc/Intro-To-PKI.md b/doc/Intro-To-PKI.md
index cd8217b4a..00bb031ae 100644
--- a/doc/Intro-To-PKI.md
+++ b/doc/Intro-To-PKI.md
@@ -18,7 +18,7 @@ documentation. Short forms may be substituted for longer forms as convenient.
     CA. The certificate contains the public key, some details describing the
     cert itself, and a digital signature from the CA.
  *  **request**: Certificate Request (optionally 'req'.) This is a request for a
-    certificate that is then send to a CA for signing. A request contains the
+    certificate that is then sent to a CA for signing. A request contains the
     desired cert information along with a digital signature from the private
     key.
  *  **keypair**: A keypair is an asymmetric cryptographic pair of keys. These
@@ -37,7 +37,7 @@ PKI mixed in with one used to generate end-entity certificates, such as clients
 or servers (VPN or web servers.)
 
 To start a new PKI, the CA is first created on the secure environment.
-Depending on security needs, this could managed under a locked down account,
+Depending on security needs, this could be managed under a locked down account,
 dedicated system, or even a completely offline system or using removable media
 to improve security (after all, you can't suffer an online break-in if your
 system or PKI is not online.) The exact steps to create a CA are described in a
diff --git a/doc/TODO b/doc/TODO
index f3c3b6d1e..d7dc456e5 100644
--- a/doc/TODO
+++ b/doc/TODO
@@ -9,7 +9,7 @@ Feature support:
         * Keep platform-specific tools separate from platform-neutral code
     * add detection for duplicate CN prior to OpenSSL failure
         * This gets tricky if `updatedb` requires a CA passphrase
-	* It would help to warn users before OpenSSL throws errors
+    * It would help to warn users before OpenSSL throws errors
 
 Longer term wishlist:
     * Support openssl's -password source mechanism:
diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 6fec28896..dc3f898fa 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -2,223 +2,771 @@
 
 # Easy-RSA 3 -- A Shell-based CA Utility
 #
-# Copyright (C) 2013 by the Open-Source OpenVPN development community.
-# A full list of contributors can be found in the ChangeLog.
+# Copyright (C) 2025 - The Open-Source OpenVPN development community.
+# A full list of contributors can be found on Github at:
+#   https://github.com/OpenVPN/easy-rsa/graphs/contributors
 #
-# This code released under version 2 of the GNU GPL; see COPYING and the
-# Licensing/ directory of this project for full licensing details.
+# This code released under version 2 of the GNU GPL; see COPYING
+# and the Licensing/ directory of this project for full licensing
+# details.
 
 # Help/usage output to stdout
 usage() {
 	# command help:
 	print "
-Easy-RSA 3 usage and overview
+Easy-RSA 3 global option and command overview.
+
+NOTE: Global options MUST be provided before the command.
+
+Global options:
+
+--version       : Prints EasyRSA version and build information
+--batch|-b      : Set automatic (no-prompts when possible) mode
+--silent|-s     : Disable all warnings, notices and information
+--silent-ssl|-S : Silence SSL output (Requires batch mode)
+--verbose|-v    : Enable verbose output
+
+--nopass        : Do not use passwords
+                  Can NOT be used with --passin or --passout
+--passin=ARG    : Set -passin ARG for openssl (eg: pass:xEasyRSAy)
+--passout=ARG   : Set -passout ARG for openssl (eg: pass:xEasyRSAy)
+--rawca         : Build CA with password via RAW SSL input
+
+--pki=DIR       : Declare the PKI directory
+                  (Default PKI directory is sub-directory 'pki')
+                  See Advanced.md for in depth usage.
+--vars=FILE     : Define a specific 'vars' file to use for Easy-RSA config
+                  (Default vars file is in the current working PKI)
+
+--umask=ARG     : Define a UMASK (Default 077)
+--noumask       : Do not use a UMASK, fall back to file system default.
+--ssl-cnf=FILE  : Define a specific OpenSSL config file for Easy-RSA to use
+                  (Default config file is in the EasyRSA PKI directory)
+--force-safe-ssl: Always generate a safe SSL config file
+                  (Default: Generate Safe SSL config once per instance)
+--force-vars    : Ignore known errors in 'vars' file
+--nolockfile    : Disable lock-file (Useful for read-only PKI)
+--noinline      : Disable inline file creation
+--tmp-dir=DIR   : Declare the temporary directory
+                  (Default temporary directory is the EasyRSA PKI directory)
+--keep-tmp=NAME : Keep the original temporary session by name: NAME
+                  NAME is a sub-directory of the dir declared by --tmp-dir
+                  This option ALWAYS over-writes a sub-dir of the same name.
 
-USAGE: easyrsa [options] COMMAND [command-options]
+Certificate & Request options: (these impact cert/req field values)
+
+--text          : Create certificate requests with human readable text
+--notext        : Create certificates without human readable text
+--days=#        : Sets the signing validity to the specified number of days
+                  Applies to other commands. For details, see: 'help days'
+--startdate=DATE: Sets the SSL option '-startdate' (Format '[YY]YYMMDDhhmmssZ')
+--enddate=DATE  : Sets the SSL option '-enddate' (Format '[YY]YYMMDDhhmmssZ')
+
+--digest=ALG    : Digest to use in the requests & certificates
+--keysize=#     : Size in bits of keypair to generate (RSA Only)
+--algo=ALG      : Crypto algorithm to use: choose rsa (default), ec or ed
+--curve=NAME    : For elliptic curve, sets the named curve
+                  (Default: algo ec: secp384r1, algo ed: ed25519)
+                  (--use-algo and --curve can be used to configure 'init-pki')
+
+--subca-len=#   : Path length of signed intermediate CA certificates
+--copy-ext      : Copy included request X509 extensions (namely subjAltName)
+                  For more info, see: 'easyrsa help copyext'
+
+--san|--subject-alt-name=SUBJECT_ALT_NAME
+                : Add a subjectAltName. Can be used multiple times.
+                  For more info and syntax, see: 'easyrsa help altname'
+--auto-san      : Use commonName as subjectAltName: 'DNS:commonName'
+                  If commonName is 'n.n.n.n' then set 'IP:commonName'
+
+--san-crit      : Mark X509v3 subjectAltName as critical
+--bc-crit       : Add X509 'basicContraints = critical' attribute.
+--ku-crit       : Add X509 'keyUsage = critical' attribute.
+--eku-crit      : Add X509 'extendedKeyUsage = critical' attribute.
+
+--new-subject='SUBJECT'
+                : Specify a new subject field to sign a request with.
+                  For more info and syntax, see: 'easyrsa help subject'
+
+--usefn=NAME    : export-p12, set 'friendlyName' to NAME
+                  For more, see: 'easyrsa help friendly'
+
+Distinguished Name mode:
+
+--dn-mode=MODE  : Distinguished Name mode to use 'cn_only' (Default) or 'org'
+
+--req-cn=NAME   : Request commonName
+
+  Distinguished Name Organizational options: (only used with '--dn-mode=org')
+  --req-c=CC           : Country code (2-letters)
+  --req-st=NAME        : State/Province
+  --req-city=NAME      : City/Locality
+  --req-org=NAME       : Organization
+  --req-email=NAME     : Email addresses
+  --req-ou=NAME        : Organizational Unit
+  --req-serial=VALUE   : Entity serial number (Only used when declared)
+
+Deprecated features:
 
-A list of commands is shown below. To get detailed usage and help for a
-command, run:
-  ./easyrsa help COMMAND
+--ns-cert             : Include deprecated Netscape extensions
+--ns-comment=COMMENT  : Include deprecated Netscape comment (may be blank)
 
-For a listing of options that can be supplied before the command, use:
-  ./easyrsa help options
 
-Here is the list of commands available with a short syntax reminder. Use the
-'help' command above to get full usage details.
+Command list:
 
-  init-pki
+  init-pki [ cmd-opts ]
+  self-sign-server <file_name_base> [ cmd-opts ]
+  self-sign-client <file_name_base> [ cmd-opts ]
   build-ca [ cmd-opts ]
   gen-dh
-  gen-req <filename_base> [ cmd-opts ]
-  sign-req <type> <filename_base>
-  build-client-full <filename_base> [ cmd-opts ]
-  build-server-full <filename_base> [ cmd-opts ]
-  revoke <filename_base>
+  gen-req <file_name_base> [ cmd-opts ]
+  sign-req <type> <file_name_base> [ cmd-opts ]
+  build-client-full <file_name_base> [ cmd-opts ]
+  build-server-full <file_name_base> [ cmd-opts ]
+  build-serverClient-full <file_name_base> [ cmd-opts ]
+  inline <file_name_base>
+  expire <file_name_base>
+  renew-ca
+  renew <file_name_base>
+  revoke <file_name_base> [ cmd-opts ]          # DEPRECATED
+  revoke-issued <file_name_base> [ cmd-opts ]   # REPLACEMENT
+  revoke-expired <file_name_base> [ cmd-opts ]
+  revoke-renewed <file_name_base> [ cmd-opts ]
   gen-crl
   update-db
-  show-req <filename_base> [ cmd-opts ]
-  show-cert <filename_base> [ cmd-opts ]
-  import-req <request_file_path> <short_basename>
-  export-p7 <filename_base> [ cmd-opts ]
-  export-p12 <filename_base> [ cmd-opts ]
-  set-rsa-pass <filename_base> [ cmd-opts ]
-  set-ec-pass <filename_base> [ cmd-opts ]
-"
-
-	# collect/show dir status:
-	local err_source="Not defined: vars autodetect failed and no value provided"
-	local work_dir="${EASYRSA:-$err_source}"
-	local pki_dir="${EASYRSA_PKI:-$err_source}"
-	print "\
-DIRECTORY STATUS (commands would take effect on these locations)
-  EASYRSA: $work_dir
-      PKI:  $pki_dir
+  show-req <file_name_base> [ cmd-opts ]
+  show-cert <file_name_base> [ cmd-opts ]
+  show-ca [ cmd-opts ]
+  show-crl
+  show-expire <file_name_base> (Optional)
+  show-revoke <file_name_base> (Optional)
+  show-renew <file_name_base> (Optional)
+  verify-cert <file_name_base>
+  import-req <request_file_path> <short_name_base>
+  import-ca <DIR/FILE_NAME>
+  import-tls-key <DIR/FILE_NAME>
+  export-p1 <file_name_base> [ cmd-opts ]
+  export-p7 <file_name_base> [ cmd-opts ]
+  export-p8 <file_name_base> [ cmd-opts ]
+  export-p12 <file_name_base> [ cmd-opts ]
+  set-pass <file_name_base> [ cmd-opts ]
+  gen-tls-auth-key / gen-tls-crypt-key
+  write <TYPE>
+  serial|check-serial <SERIAL>
+  display-dn <FORM> <DIR/FILE_NAME>
+  show-eku <file_name_base>|<DIR/FILE_NAME>
+  rand <Decimal-Number>
 "
 } # => usage()
 
 # Detailed command help
-# When called with no args, calls usage(), otherwise shows help for a command
+# When called with no args, calls usage(),
+# otherwise shows help for a command
+# Please maintain strict indentation rules.
+# Commands are TAB indented, while text is SPACE indented.
+# 'case' indentation is minimalistic.
 cmd_help() {
-	local text opts
+	easyrsa_help_title="\
+Usage: easyrsa [ OPTIONS.. ] <COMMAND> <TARGET> [ cmd-opts.. ]"
+	unset -v text err_text opts text_only
+
 	case "$1" in
-		init-pki|clean-all) text="
-  init-pki [ cmd-opts ]
-      Removes & re-initializes the PKI dir for a clean PKI" ;;
-		build-ca) text="
-  build-ca [ cmd-opts ]
+	init-pki|clean-all)
+		text="
+* init-pki [ cmd-opts ]
+
+      Removes & re-initializes the PKI directory for a new PKI
+
+      The new PKI can be auto-configured to use alternative cryptography.
+
+      The following command line examples are equivalent:
+        $ easyrsa init-pki ed448
+        $ easyrsa init-pki ed ed448
+        $ easyrsa --use-algo=ed --curve=ed448 init-pki
+
+      Note: cmd-opts take priority over '--' global options"
+		opts="
+      * Optional algorithm 'ec' or 'ed'  (Default: rsa)
+      * Optional curve name (Default: None, secp384r1 or ed25519)"
+	;;
+	self-sign*)
+		text="
+* self-sign-server|self-sign-client <file_name_base> [ cmd-opts ]
+
+      Creates a new self-signed server|client key pair"
+
+		opts="
+      * nopass  - Do not encrypt the private key (Default: encrypted)
+                  (Equivalent to global option '--nopass|--no-pass')"
+	;;
+	build-ca)
+		text="
+* build-ca [ cmd-opts ]
+
       Creates a new CA"
-      			opts="
-        nopass  - do not encrypt the CA key (default is encrypted)
-        subca   - create a sub-CA keypair and request (default is a root CA)" ;;
-		gen-dh) text="
-  gen-dh
-      Generates DH (Diffie-Hellman) parameters" ;;
-		gen-req) text="
-  gen-req <filename_base> [ cmd-opts ]
-      Generate a standalone keypair and request (CSR)
+
+		opts="
+      * rawca   - ONLY use SSL binary to input CA password
+                  (Equivalent to global option '--rawca|--raw-ca')
+
+      * nopass  - Do not encrypt the private key (Default: encrypted)
+                  (Equivalent to global option '--nopass|--no-pass')
+
+      * subca   - Create an intermediate CA keypair and request
+        intca     (default is a root CA)"
+	;;
+	gen-dh)
+		text="
+* gen-dh
+
+      Generates DH (Diffie-Hellman) parameters file"
+	;;
+	gen-req)
+		text="
+* gen-req <file_name_base> [ cmd-opts ]
+
+      Generate a standalone-private-key and certificate-signing-request
 
       This request is suitable for sending to a remote CA for signing."
-      			opts="
-        nopass  - do not encrypt the private key (default is encrypted)" ;;
-		sign|sign-req) text="
-  sign-req <type> <filename_base>
-      Sign a certificate request of the defined type. <type> must be a known
-      type such as 'client', 'server', or 'ca' (or a user-added type.)
+
+		opts="
+      * nopass  - Do not encrypt the private key (Default: encrypted)
+                  (Equivalent to global option '--nopass|--no-pass')
+      * text    - Include certificate text in request"
+	;;
+	sign|sign-req)
+		text="
+* sign-req <type> <file_name_base> [ cmd-opts ]
+
+      Sign a certificate request of the defined type.
+
+      <type> must be a known type.
+      eg: 'client', 'server', 'serverClient', 'ca' or a user-added type.
+      All supported types are listed in the x509-types directory.
 
       This request file must exist in the reqs/ dir and have a .req file
-      extension. See import-req below for importing reqs from other sources." ;;
-		build|build-client-full|build-server-full) text="
-  build-client-full <filename_base> [ cmd-opts ]
-  build-server-full <filename_base> [ cmd-opts ]
-      Generate a keypair and sign locally for a client or server
-
-      This mode uses the <filename_base> as the X509 CN."
-			opts="
-        nopass  - do not encrypt the private key (default is encrypted)" ;;
-		revoke) text="
-  revoke <filename_base>
-      Revoke a certificate specified by the filename_base" ;;
-		gen-crl) text="
-  gen-crl
-      Generate a CRL" ;;
-		update-db) text="
-  update-db
+      extension. See 'import-req' for importing from other sources."
+		opts="
+      * newsubj  - Replace subject. See 'help subject'.
+      * preserve - Use the DN-field order of the CSR not the CA."
+	;;
+	build|build-client-full|build-server-full|build-serverClient-full)
+		text="
+* build-client-full <file_name_base> [ cmd-opts ]
+* build-server-full <file_name_base> [ cmd-opts ]
+* build-serverClient-full <file_name_base> [ cmd-opts ]
+
+      Generate a keypair and sign locally.
+
+      This mode uses the <file_name_base> as the X509 commonName."
+
+		opts="
+      * nopass  - Do not encrypt the private key (Default: encrypted)
+                  (Equivalent to global option '--nopass|--no-pass')"
+	;;
+	inline)
+		text="
+* inline <file_name_base>
+
+      Create inline file for <file_name_base>."
+	;;
+	revoke*)
+		text="
+* revoke <file_name_base> [ reason ]
+
+      Revoke a certificate specified by the <file_name_base>,
+      with an optional revocation [ reason ].
+
+      Values accepted for option [ reason ]:
+         us | uns* | unspecified
+         kc | key* | keyCompromise
+         cc | ca*  | CACompromise
+         ac | aff* | affiliationChanged
+         ss | sup* | superseded
+         co | ces* | cessationOfOperation
+         ch | cer* | certificateHold
+
+      Commands 'revoke-expired' and 'revoke-renewed' are functionally
+      equivalent to 'revoke-issued', however, they are used to revoke
+      certificates which have been either 'expired' or 'renewed' by
+      Easy-RSA commands 'expire' or 'renew'.
+
+      Commmand 'revoke' is DEPRECATED and can ONLY be used in batch mode.
+      Commmand 'revoke-issued' REPLACES command 'revoke'.
+
+      REQUIRED COMMANDS:
+
+      * 'revoke-issued' <file_name_base> [ reason ]
+        Revoke a current, issued certificate.
+        Archives the original request and private key files.
+
+      * 'revoke-expired' <file_name_base> [ reason ]
+        Revoke an old, expired certificate.
+        Preserves the original request and private key files.
+
+      * 'revoke-renewed' <file_name_base> [ reason ]
+        Revoke an old, renewed certificate.
+        Preserves the original request and private key files.
+
+        All 'revoke' commands archive the specified certificate
+        by serial number."
+		opts="
+      * [ reason ]${NL}
+      Values accepted for option [ reason ]: Details above."
+	;;
+	expire)
+		text="
+* expire <file_name_base>
+
+      Move a certificate specified by <file_name_base>
+      to the 'pki/expired' directory.
+
+      Allows an existing request to be signed again."
+	;;
+	renew-ca)
+		text="
+* renew-ca
+
+      Renew CA certificate.
+
+      This will build a new CA certificate and archive the old one.
+      Before changes are made to the current PKI, user confirmation
+      is required."
+	;;
+	renew)
+		text="
+* renew <file_name_base>
+
+      Renew a certificate specified by <file_name_base>"
+	;;
+	gen-crl)
+		text="
+* gen-crl
+
+      Generate a certificate revocation list [CRL]"
+	;;
+	update-db)
+		text="
+* update-db
+
       Update the index.txt database
 
-      This command will use the system time to update the status of issued
-      certificates." ;;
-      		show-req|show-cert) text="
-  show-req  <filename_base> [ cmd-opts ]
-  show-cert <filename_base> [ cmd-opts ]
-      Shows details of the req or cert referenced by filename_base
-
-      Human-readable output is shown, including any requested cert options when
-      showing a request."
-      			opts="
-          full   - show full req/cert info, including pubkey/sig data" ;;
-		import-req) text="
-  import-req <request_file_path> <short_basename>
+      This command will use the system time to update the status of
+      issued certificates."
+	;;
+	show-req|show-cert)
+		text="
+* show-req  <file_name_base> [ cmd-opts ]
+* show-cert <file_name_base> [ cmd-opts ]
+
+      Shows details of the req or cert referenced by <file_name_base>
+
+      Human-readable output is shown, including any requested cert
+      options when showing a request."
+
+		opts="
+      * full    - show full req/cert info, including pubkey/sig data"
+	;;
+	show-ca)
+		text="
+* show-ca [ cmd-opts ]
+
+      Shows details of the Certificate Authority [CA] certificate
+
+      Human-readable output is shown."
+
+		opts="
+      * full    - show full CA info, including pubkey/sig data"
+	;;
+	show-crl)
+		text="
+* show-crl
+
+      Shows details of the current certificate revocation list (CRL)
+
+      Human-readable output is shown."
+	;;
+	verify|verify-cert)
+		text="
+* verify-cert <file_name_base> [ cmd-opts ]
+
+      Verify certificate against CA
+
+      Returns the current validity of the certificate."
+
+		opts="
+      * batch   - On failure to verify, return error (1) to caller"
+	;;
+	import-req)
+		text="
+* import-req <request_file_path> <short_name_base>
+
       Import a certificate request from a file
 
       This will copy the specified file into the reqs/ dir in
       preparation for signing.
-      The <short_basename> is the filename base to create.
+
+      The <short_name_base> is the <file_name_base> to create.
+
+      Example usage:
+        import-req /some/where/bob_request.req bob"
+	;;
+	import-ca)
+		text="
+* import-ca <DIR/FILE_NAME>
+
+      Import a CA certificate from '<DIR/FILE_NAME>'
+
+      Add the specified file to the 'pki/inline/external-ca.list' file,
+      for use by OpenVPN inline files. Allows multiple external CAs.
+
+      The 'pki/inline/external-ca.list' file is automatically added
+      to all new inline files, within the <ca>..</ca> tags.
+
+      This allows OpenVPN inline support for PKIs with independent CAs,
+      Sub CAs or cross-signed CAs.
+
+      The <DIR/FILE_NAME> is imported WITHOUT X509/CA verification.
+
+      Example usage:
+        import-ca '/another/pki/ca.crt'"
+	;;
+	import-tls-key)
+		text="
+* import-tls-key <DIR/FILE_NAME>
+
+      Import an OpenVPN TLS key from '<DIR/FILE_NAME>'
+
+      Copy the specified file to 'pki/private/easyrsa-tls.key' file,
+      for use by OpenVPN inline files.
+
+      The 'pki/private/easyrsa-tls.key' file is automatically added
+      to all new inline files, within the <tls-*>..</tls-*> tags.
+
+      The <DIR/FILE_NAME> is imported WITHOUT verification.
 
       Example usage:
-        import-req /some/where/bob_request.req bob" ;;
-		export-p12) text="
-  export-p12 <filename_base> [ cmd-opts ]
-      Export a PKCS#12 file with the keypair specified by <filename_base>"
-			opts="
-        noca  - do not include the ca.crt file in the PKCS12 output
-        nokey - do not include the private key in the PKCS12 output" ;;
-		export-p7) text="
-  export-p7 <filename_base> [ cmd-opts ]
-      Export a PKCS#7 file with the pubkey specified by <filename_base>"
-			opts="
-        noca  - do not include the ca.crt file in the PKCS7 output" ;;
-		set-rsa-pass|set-ec-pass) text="
-  set-rsa-pass <filename_base> [ cmd-opts ]
-  set-ec-pass <filename_base> [ cmd-opts ]
-      Set a new passphrase on an RSA or EC key for the listed <filename_base>."
-                        opts="
-        nopass - use no password and leave the key unencrypted
-        file   - (advanced) treat the file as a raw path, not a short-name" ;;
-		altname|subjectaltname|san) text="
-  --subject-alt-name=SAN_FORMAT_STRING
+        import-tls-key '/another/pki/private/easyrsa-tls.key'"
+	;;
+	export-p12)
+		text="
+* export-p12 <file_name_base> [ cmd-opts ]
+
+      Export a PKCS#12 file with the keypair,
+      specified by <file_name_base>"
+
+		opts="
+      * nopass  - Do not encrypt the private key (Default: encrypted)
+                  (Equivalent to global option '--nopass|--no-pass')
+      * noca    - Do not include the ca.crt file in the PKCS12 output
+      * nokey   - Do not include the private key in the PKCS12 output
+      * nofn    - Do not set 'friendlyName'
+                  For more, see: 'easyrsa help friendly'
+      * legacy  - Use legacy algorithm: RC2_CBC or 3DES_CBC + MAC: SHA1
+                  (Default algorithm: AES-256-CBC + MAC: SHA256)"
+	;;
+	friendly)
+		text_only=1
+		text="
+* export-p12: Internal file label 'friendlyName'
+
+      The 'friendlyname' is always set to the file-name-base.
+
+      An alternate friendlyName can be configured by using:
+      * Global option '--usefn=<friendlyName>'
+
+      Fallback to previous behavior can be configured by using:
+      * Command option 'nofn' ('friendlyname' will not be set)"
+	;;
+	export-p7)
+		text="
+* export-p7 <file_name_base> [ cmd-opts ]
+
+      Export a PKCS#7 file with the pubkey,
+      specified by <file_name_base>"
+
+		opts="
+      * noca    - Do not include the ca.crt file in the PKCS7 output"
+	;;
+	export-p8)
+		text="
+* export-p8 <file_name_base> [ cmd-opts ]
+
+      Export a PKCS#8 file with the private key,
+      specified by <file_name_base>"
+
+		opts="
+      * nopass  - Do not encrypt the private key (Default: encrypted)
+                  (Equivalent to global option '--nopass|--no-pass')"
+	;;
+	export-p1)
+		text="
+* export-p1 <file_name_base> [ cmd-opts ]
+
+      Export a PKCS#1 (RSA format) file with the pubkey,
+      specified by <file_name_base>"
+
+		opts="
+      * nopass  - Do not encrypt the private key (Default: encrypted)
+                  (Equivalent to global option '--nopass|--no-pass')"
+	;;
+	set-pass|set-ed-pass|set-rsa-pass|set-ec-pass)
+		text="
+* set-pass <file_name_base> [ cmd-opts ]
+
+      Set a new passphrase for the private key specified by <file_name_base>
+
+  DEPRECATED: 'set-rsa-pass' and 'set-ec-pass'"
+
+		opts="
+      * nopass  - Do not encrypt the private key (Default: encrypted)
+                  (Equivalent to global option '--nopass|--no-pass')
+      * file    - (Advanced) Treat the file as a raw path, not a short-name"
+	;;
+	write)
+		text="
+* write <type>
+
+      Write <type> data to stdout
+
+      Types:
+      * vars     - Write vars.example file.
+      * ssl-cnf  - Write EasyRSA SSL config file.
+      * safe-cnf - Write expanded EasyRSA SSL config file for LibreSSL.
+      * COMMON|ca|server|serverClient|client|codeSigning|email
+                 - Write x509-type <type> file.
+
+      * legacy   - Write ALL support files (above) to the PKI directory.
+                   Will create '\$EASYRSA_PKI/x509-types' directory.
+      * legacy-hard
+                 - Same as 'legacy' plus OVER-WRITE files."
+	;;
+	--san|--subject-alt-name|altname|subjectaltname|san)
+		text_only=1
+		text="
+* Global Option: --subject-alt-name=SAN_FORMAT_STRING
+
       This global option adds a subjectAltName to the request or issued
       certificate. It MUST be in a valid format accepted by openssl or
-      req/cert generation will fail. Note that including multiple such names
-      requires them to be comma-separated; further invocations of this
-      option will REPLACE the value.
+      req/cert generation will fail. NOTE: --san can be specified more
+      than once on the command line.
+
+      The following two command line examples are equivalent:
+      1. --san=DNS:server1,DNS:serverA,IP:10.0.0.1
+      2. --san=DNS:server1 --san=DNS:serverA --san=IP:10.0.0.1
 
       Examples of the SAN_FORMAT_STRING shown below:
-        DNS:alternate.example.net
-        DNS:primary.example.net,DNS:alternate.example.net
-        IP:203.0.113.29
-        email:alternate@example.net" ;;
-		options)
-			opt_usage ;;
-		"")
-			usage ;;
-		*) text="
-  Unknown command: '$1' (try without commands for a list of commands)" ;;
+
+      * DNS:alternate.example.net
+      * DNS:primary.example.net,DNS:alternate.example.net
+      * IP:203.0.113.29
+      * email:alternate@example.net"
+	;;
+	--copy-ext|copy-ext|copyext)
+		text_only=1
+		text="
+* Global Option: How to use --copy-ext and --san=<SAN>
+
+    These are the only commands that support --copy-ext and/or --san.
+
+    Command 'gen-req':
+      --san: Add SAN extension to the request file.
+
+    Command 'sign-req':
+      --copy-ext: Copy all request extensions to the signed certificate.
+      --san: Over write the request SAN with option SAN.
+
+    Command 'build-*-full':
+      --copy-ext: Always enabled.
+      --san: Add SAN extension to the request and signed certificate.
+
+    See 'help san' for option --san full syntax."
+	;;
+	--days|days)
+		text_only=1
+		text="
+* Global Option: --days=DAYS
+
+      This global option is an alias for one of the following:
+      * Expiry days for a new CA.
+        eg: '--days=3650 build-ca'
+      * Expiry days for new/renewed certificate.
+        eg: '--days=1095 renew server'
+      * Expiry days for certificate revocation list.
+        eg: '--days=180 gen-crl'
+      * Cutoff days for command: show-expire.
+        eg: '--days=90 show-expire'"
+	;;
+	--new-subj*|new-subj*|newsubj*|subject)
+		text_only=1
+		text="
+* Global Option: --new-subject=<SUBJECT>
+
+      This global option is used to set the new certificate subject,
+      when signing a new certificate
+
+* REQUIRES Command option: 'newsubj', for command 'sign-req'
+
+      Using command 'sign-req', add command option 'newsubj',
+      to FORCE the --new-subject to be used.
+
+      Example:
+      --new-subject='/CN=foo' sign-req client bar newsubj
+
+      See OpenSSL command 'ca', option -subj, for full details."
+	;;
+	serial|check-serial)
+		text_only=1
+		text="
+* serial|check-serial <SERIAL>
+
+      Check certificate <SERIAL> number is unique."
+	;;
+	display-dn)
+		text_only=1
+		text="
+* display-dn <form> <DIR/FILE_NAME>
+
+      Display DN of request or certificate: <form> = req|x509"
+	;;
+	show-eku)
+		text_only=1
+		text="
+* show-eku <file_name_base>|<DIR/FILE_NAME>
+
+      Display Extended Key Usage of certificate."
+	;;
+	rand|random)
+		text_only=1
+		text="
+* rand <decimal_number>
+
+      Generate random hex."
+	;;
+	show-expire|show-revoke|show-renew)
+		text_only=1
+		text="
+* show-expire <file_name_base> (Optional)
+
+      Show a list of certificates which will expire in
+      the number of --days. (Default: 90 days)
+
+* show-revoke <file_name_base> (Optional)
+
+      Show a list of revoked certificates.
+
+* show-renew <file_name_base> (Optional)
+
+      Show a list of renewed certificates."
+	;;
+	gen-tls*)
+		text="
+Generate TLS keys for use with OpenVPN:
+
+      gen-tls-auth-key    : Generate OpenVPN TLS-AUTH key
+
+      gen-tls-crypt-key   : Generate OpenVPN TLS-CRYPT-V1 key (Preferred)
+
+Only ONE TLS key is allowed to exist. (pki/private/easyrsa-tls.key)
+This TLS key will be automatically added to inline files."
+	;;
+	"")
+		usage
+		cleanup ok
+	;;
+	*)
+		err_text="
+  Unknown command: '$1' \
+(try without commands for a list of commands)"
+		easyrsa_exit_with_error=1
 	esac
 
-	# display the help text
-	print "$text"
-	[ -n "$opts" ] && print "
-      cmd-opts is an optional set of command options from this list:
-$opts"
+	if [ "$err_text" ]; then
+		print "$easyrsa_help_title"
+		print "${err_text}"
+	else
+		# display the help text
+		print "$easyrsa_help_title"
+		[ "$text" ] && print "$text"
+
+		if [ "$text_only" ]; then
+			: # ok - No opts message required
+		else
+			print "
+    Available command options [ cmd-opts ]:
+${opts:-
+      * No supported command options}"
+		fi
+	fi
+	print
 } # => cmd_help()
 
-# Options usage
-opt_usage() {
+# default help
+default_overview() {
 	print "
-Easy-RSA Global Option Flags
+Easy-RSA 3 Overview:
 
-The following options may be provided before the command. Options specified
-at runtime override env-vars and any 'vars' file in use. Unless noted,
-non-empty values to options are mandatory.
+To get a list of available options and commands, use:
+  ./easyrsa help
 
-General options:
+To get detailed usage and help for commands, use:
+  ./easyrsa help <COMMAND>"
 
---batch         : set automatic (no-prompts when possible) mode
---pki-dir=DIR   : declares the PKI directory
---vars=FILE     : define a specific 'vars' file to use for Easy-RSA config
-
-Certificate & Request options: (these impact cert/req field values)
-
---days=#        : sets the signing validity to the specified number of days
---digest=ALG    : digest to use in the requests & certificates
---dn-mode=MODE  : DN mode to use (cn_only or org)
---keysize=#     : size in bits of keypair to generate
---req-cn=NAME   : default CN to use
---subca-len=#   : path length of signed sub-CA certs; must be >= 0 if used
---subject-alt-name : Add a subjectAltName. For more info and syntax, see:
-                     ./easyrsa help altname
---use-algo=ALG  : crypto alg to use: choose rsa (default) or ec
---curve=NAME    : for elliptic curve, sets the named curve to use
-
-Organizational DN options: (only used with the 'org' DN mode)
-  (values may be blank for org DN options)
-
---req-c=CC        : country code (2-letters)
---req-st=NAME     : State/Province
---req-city=NAME   : City/Locality
---req-org=NAME    : Organization
---req-email=NAME  : Email addresses
---req-ou=NAME     : Organizational Unit
+	# collect/show dir status:
+	text_only=1
+	work_dir="${EASYRSA:-undefined}"
+	pki_dir="${EASYRSA_PKI:-undefined}"
+
+	# check for vars changing PKI unexpectedly!
+	if [ "$invalid_vars" ]; then
+		ivmsg="
+   *WARNING*: \
+Invalid vars setting for EASYRSA and/or EASYRSA_PKI${NL}"
+	else
+		unset -v ivmsg
+	fi
 
-Deprecated features:
+	# Print details
+	print "
+DIRECTORY STATUS (commands would take effect on these locations)
+     EASYRSA: $work_dir
+         PKI: $pki_dir
+   vars-file: ${EASYRSA_VARS_FILE:-Missing or undefined}${ivmsg}"
+
+	# Print algo details
+	print "   Algorithm: $EASYRSA_ALGO"
+	case "$EASYRSA_ALGO" in
+		rsa) print "    Key size: $EASYRSA_KEY_SIZE" ;;
+		ec|ed) print "       Curve: $EASYRSA_CURVE" ;;
+		*) print "   Algorithm: UNKNOWN!"
+	esac
 
---ns-cert=YESNO       : yes or no to including deprecated NS extensions
---ns-comment=COMMENT  : NS comment to include (value may be blank)
-"
-} # => opt_usage()
+	# CA Status
+	if verify_ca_init test; then
+		if [ -z "$EASYRSA_SILENT" ]; then
+			# Show SSL output directly, with easyrsa header
+			printf '%s' "   CA status: OK${NL}${NL}    "
+			"$EASYRSA_OPENSSL" x509 -in "$EASYRSA_PKI/ca.crt" \
+				-noout -subject -nameopt utf8,multiline
+			print "" # for a clean line
+		fi
+	else
+		if [ -f "$EASYRSA_PKI"/peer-fp.mode ]; then
+			print "\
+   CA status: No CA, Peer-Fingerprint only PKI enabled${NL}"
+		else
+			print "\
+   CA status: CA has not been built${NL}"
+		fi
+	fi
+} # => default_overview()
 
 # Wrapper around printf - clobber print since it's not POSIX anyway
-print() { printf "%s\n" "$*"; }
+# print() is used internally, so MUST NOT be silenced.
+# shellcheck disable=SC1117 # printf format - print()
+print() {
+	printf '%s\n' "$*"
+} # => print()
 
 # Exit fatally with a message to stderr
 # present even with EASYRSA_BATCH as these are fatal problems
@@ -226,992 +774,6731 @@ die() {
 	print "
 Easy-RSA error:
 
-$1" 1>&2
-	exit ${2:-1}
+$*${NL}"
+
+	# error_info is for hard-to-spot errors!
+	if [ "$error_info" ]; then
+		print "  * $cmd: ${error_info}${NL}"
+	fi
+
+	# show host info
+	show_host
+
+	# exit to cleanup()
+	exit "${2:-1}"
 } # => die()
 
+# User errors, less noise than die()
+user_error() {
+	print "
+EasyRSA version $EASYRSA_version
+
+Error
+-----
+$*${NL}"
+
+	easyrsa_exit_with_error=1
+	cleanup
+} # => user_error()
+
+# verbose information
+verbose() {
+	[ "$EASYRSA_VERBOSE" ] || return 0
+	print "  # $fn_name; $*"
+} # => verbose()
+
 # non-fatal warning output
 warn() {
-	[ ! $EASYRSA_BATCH ] && \
-		print "
-$1" 1>&2
+	[ "$EASYRSA_SILENT" ] && return
+	print "
+WARNING
+=======
+$*${NL}"
 } # => warn()
 
 # informational notices to stdout
 notice() {
-	[ ! $EASYRSA_BATCH ] && \
-		print "
-$1"
+	[ "$EASYRSA_SILENT" ] && return
+	print "
+Notice
+------
+$*${NL}"
 } # => notice()
 
-# yes/no case-insensitive match (operates on stdin pipe)
-# Returns 0 when input contains yes, 1 for no, 2 for no match
-# If both strings are present, returns 1; first matching line returns.
-awk_yesno() {
-	local awkscript='
-BEGIN {IGNORECASE=1; r=2}
-{       if(match($0,"no")) {r=1; exit}
-        if(match($0,"yes")) {r=0; exit}
-} END {exit r}'
-	awk "$awkscript"
-} # => awk_yesno()
+# Helpful information
+information() {
+	[ "$EASYRSA_SILENT" ] && return
+	print "$*"
+} # => information()
 
 # intent confirmation helper func
 # returns without prompting in EASYRSA_BATCH
 confirm() {
-	[ $EASYRSA_BATCH ] && return
-	local prompt="$1" value="$2" msg="$3" input
-	print "
+	[ "$EASYRSA_BATCH" ] && return
+	prompt="$1"
+	value="$2"
+	msg="$3"
+	input=""
+	print "\
 $msg
 
 Type the word '$value' to continue, or any other input to abort."
 	printf %s "  $prompt"
+	# shellcheck disable=SC2162 # read without -r - confirm()
 	read input
+	printf '\n'
 	[ "$input" = "$value" ] && return
+	easyrsa_exit_with_error=1
+	unset -v EASYRSA_SILENT
 	notice "Aborting without confirmation."
-	exit 9
+	cleanup
 } # => confirm()
 
-# remove temp files
-clean_temp() {
-	for f in "$EASYRSA_TEMP_FILE" "$EASYRSA_TEMP_FILE_2" "$EASYRSA_TEMP_FILE_3"
-	do	[ -f "$f" ] && rm "$f" 2>/dev/null
-	done
-} # => clean_temp()
-
-vars_source_check() {
-	# Check for defined EASYRSA_PKI
-	[ -n "$EASYRSA_PKI" ] || die "\
-EASYRSA_PKI env-var undefined"
+# Generate random hex
+easyrsa_random() {
+	case "$1" in
+		*[!1234567890]*|0*|"")
+			die "easyrsa_random - input"
+	esac
 
-	# Verify EASYRSA_OPENSSL command gives expected output
-	if [ -z "$EASYRSA_SSL_OK" ]; then
-		local val="$("$EASYRSA_OPENSSL" version)"
-		case "${val%% *}" in
-			OpenSSL|LibreSSL) ;;
-			*) die "\
-Missing or invalid OpenSSL
-Expected to find openssl command at: $EASYRSA_OPENSSL"
-		esac
+	if rand_hex="$(
+			"$EASYRSA_OPENSSL" rand -hex "$1" 2>/dev/null
+		)"
+	then
+		if [ "$2" ]; then
+			force_set_var "$2" "$rand_hex"
+		else
+			print "$rand_hex"
+		fi
+		unset -v rand_hex
+		return 0
 	fi
-	EASYRSA_SSL_OK=1
 
-	# Verify EASYRSA_SSL_CONF file exists
-	[ -f "$EASYRSA_SSL_CONF" ] || die "\
-The OpenSSL config file cannot be found.
-Expected location: $EASYRSA_SSL_CONF"
-} # => vars_source_check()
+	die "easyrsa_random failed"
+} # => easyrsa_random()
 
-# Verify supplied curve exists and generate curve file if needed
-verify_curve() {
-	if ! "$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" > /dev/null; then
-		die "\
-Curve $EASYRSA_CURVE not found. Run openssl ecparam -list_curves to show a
-list of supported curves."
+# Set noclobber on|off
+set_no_clobber() {
+	verbose "${2:-undefined}; set_no_clobber; $1"
+	case "$1" in
+		on)
+			set -o noclobber && return
+			set -C && return
+		;;
+		off)
+			set +o noclobber && return
+			set +C && return
+		;;
+		*)
+			: # drop to error
+	esac
+	die "set_no_clobber() $1, Failed"
+} # => set_no_clobber()
+
+# Create lock-file
+create_lock_file() {
+	# Force noclobber
+	set_no_clobber on create_lock_file
+
+	# Create lock-file from PID
+	[ "$1" ] || die "create_lock_file - input"
+	print "$$" 2>/dev/null 1>"$1" || return 1
+	verbose "create_lock_file; CREATED '$1'"
+
+	# unset noclobber
+	set_no_clobber off create_lock_file
+} # => create_lock_file()
+
+# Remove lock-file, if lock_data matches PID
+remove_lock_file() {
+	if [ "$2" = "$$" ]; then
+		rm "$1" 2>/dev/null || return 1
+	elif [ "$2" = FORCE ]; then
+		rm "$1" 2>/dev/null || return 1
+	else
+		return 1
+	fi
+} # => remove_lock_file()
+
+# Create session directory atomically or fail
+secure_session() {
+	# Session must not be defined
+	[ "$secured_session" ] && die "session overload"
+
+	# Temporary directory must exist
+	[ -d "$EASYRSA_TEMP_DIR" ] || die "\
+secure_session - Missing temporary directory:
+* $EASYRSA_TEMP_DIR"
+
+	for i in 1 2 3; do
+		session=
+		easyrsa_random 4 session
+		secured_session="${EASYRSA_TEMP_DIR}/${session}"
+
+		# atomic:
+		if mkdir "$secured_session"; then
+			# New session requires safe-ssl conf
+			unset -v session OPENSSL_CONF
+
+			easyrsa_err_log="$secured_session/error.log"
+			verbose "secure_session; CREATED $secured_session"
+			return
+		fi
+	done
+	die "secure_session failed"
+} # => secure_session()
+
+# Remove secure session
+remove_secure_session() {
+	[ -d "$secured_session" ] || return 0
+	if rm -rf "$secured_session"; then
+		verbose "remove_secure_session; DELETED $secured_session"
+		unset -v secured_session EASYRSA_SSL_CONF OPENSSL_CONF
+		return
+	fi
+	die "remove_secure_session Failed: $secured_session"
+} # => remove_secure_session()
+
+# Create temp-file atomically or fail
+# WARNING: Running easyrsa_openssl in a subshell
+# will hide error message and verbose messages
+# from easyrsa_mktemp()
+easyrsa_mktemp() {
+	if [ -z "$1" ] || [ "$2" ]; then
+		die "easyrsa_mktemp - input error"
 	fi
 
-	# Check that the ecparams dir exists
-	[ -d "$EASYRSA_EC_DIR" ] || mkdir "$EASYRSA_EC_DIR" || die "\
-Failed creating ecparams dir (permissions?) at:
-$EASYRSA_EC_DIR"
+	# session directory must exist
+	[ -d "$secured_session" ] || die "\
+easyrsa_mktemp - Temporary session undefined (--tmp-dir)"
 
-	# Check that the required ecparams file exists
-	local out="$EASYRSA_EC_DIR/${EASYRSA_CURVE}.pem"
-	[ -f "$out" ] && return 0
-	"$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" -out "$out" || die "\
-Failed to generate ecparam file (permissions?) when writing to:
-$out"
+	# Force noclobber
+	set_no_clobber on easyrsa_mktemp
 
-	# Explicitly return success for caller
-	return 0
-}
+	# Create shotfile
+	for high in 0 1; do
+		for low in 0 1 2 3 4 5 6 7 8 9; do
+			shotfile="${secured_session}/temp.${high}${low}"
 
-# Basic sanity-check of PKI init and complain if missing
-verify_pki_init() {
-	local help_note="Run easyrsa without commands for usage and command help."
+			# atomic:
+			printf "" 2>/dev/null 1>"$shotfile" || continue
 
-	# check that the pki dir exists
-	vars_source_check
-	[ -d "$EASYRSA_PKI" ] || die "\
-EASYRSA_PKI does not exist (perhaps you need to run init-pki)?
-Expected to find the EASYRSA_PKI at: $EASYRSA_PKI
-$help_note"
+			# Assign external temp-file name
+			if force_set_var "$1" "$shotfile"; then
+				# Update counter
+				mktemp_counter="$((mktemp_counter+1))"
+				verbose "easyrsa_mktemp; $1 CREATED: $shotfile"
 
-	# verify expected dirs present:
-	for i in private reqs; do
-		[ -d "$EASYRSA_PKI/$i" ] || die "\
-Missing expected directory: $i (perhaps you need to run init-pki?)
-$help_note"
-	done
-} # => verify_pki_init()
+				# unset noclobber
+				set_no_clobber off easyrsa_mktemp
 
-# Verify core CA files present
-verify_ca_init() {
-	local help_note="Run without commands for usage and command help."
+				return
+			else
+				die "easyrsa_mktemp - force_set_var $1 failed"
+			fi
+		done
+	done
 
-	# First check the PKI has been initialized
-	verify_pki_init
+	# In case of subshell abuse, report to error log
+	err_msg="easyrsa_mktemp - failed for: $1"
+	print "$err_msg" > "$easyrsa_err_log"
+	die "$err_msg"
+} # => easyrsa_mktemp()
+
+# remove temp files and do terminal cleanups
+cleanup() {
+	fn_name=cleanup
+	# In case of subshell abuse, display error log file
+	if [ -f "$easyrsa_err_log" ]; then
+		print; cat "$easyrsa_err_log"; print
+	fi
 
-	# verify expected files present:
-	for i in serial index.txt ca.crt private/ca.key; do
-		if [ ! -f "$EASYRSA_PKI/$i" ]; then
-			[ "$1" = "test" ] && return 1
-			die "\
-Missing expected CA file: $i (perhaps you need to run build-ca?)
-$help_note"
+	# undo changes BEFORE delete temp-dir
+	# Remove files when build_full()->sign_req() is interrupted
+	[ "$error_build_full_cleanup" ] && \
+		rm -f "$crt_out" "$req_out" "$key_out"
+
+	# Restore files when renew is interrupted
+	[ "$error_undo_renew_move" ] && renew_restore_move
+
+	# Remove temp-session or create temp-snapshot
+	if [ -d "$secured_session" ]; then
+		if [ "$EASYRSA_KEEP_TEMP" ]; then
+			# skip on black-listed directory names, with a warning
+			# Use '-e' for directory or file name
+			if [ -e "$EASYRSA_TEMP_DIR/$EASYRSA_KEEP_TEMP" ]
+			then
+				warn "\
+Prohibited value for --keep-tmp: '$EASYRSA_KEEP_TEMP'
+Temporary session not preserved."
+			else
+				# create temp-snapshot
+				keep_tmp="$EASYRSA_TEMP_DIR/tmp/$EASYRSA_KEEP_TEMP"
+				mkdir -p "${keep_tmp}" || die \
+					"cleanup() - Failed to create '${keep_tmp}' directory."
+
+				rm -rf "$keep_tmp"
+				mv -f "$secured_session" "$keep_tmp"
+				information "Temp session preserved: $keep_tmp"
+				unset -v secured_session
+			fi
 		fi
-	done
 
-	# When operating in 'test' mode, return success.
-	# test callers don't care about CA-specific dir structure
-	[ "$1" = "test" ] && return 0
+		# remove temp-session
+		remove_secure_session
+		verbose "mktemp_counter: $mktemp_counter uses"
+	fi
 
-	# verify expected CA-specific dirs:
-	for i in issued certs_by_serial; do
-		[ -d "$EASYRSA_PKI/$i" ] || die "\
-Missing expected CA dir: $i (perhaps you need to run build-ca?)
-$help_note"
-	done
+	# When prompt is disabled then restore prompt
+	case "$prompt_restore" in
+		''|0) : ;; # Not required
+		1)
+			[ -t 1 ] && stty echo
+			[ "$EASYRSA_SILENT" ] || print
+		;;
+		2)
+			# shellcheck disable=SC3040 # POSIX set -o
+			set -o echo
+			[ "$EASYRSA_SILENT" ] || print
+		;;
+		*) warn "Unknown prompt_restore: '$prompt_restore'"
+	esac
 
-	# explicitly return success for callers
-	return 0
+	# Clear traps
+	trap - 0 1 2 3 6 15
 
-} # => verify_ca_init()
+	# Remove lock-file
+	if [ -f "$lock_file" ] || [ "$create_lock_file_error" ]
+	then
+		# Too test this, create a lock-file
+		# and uncomment the following line
+		#read -r -p "Continue.." keypress
 
-# init-pki backend:
-init_pki() {
-	vars_source_check
+		lock_data="$(cat "$lock_file" 2>/dev/null)" || \
+			lock_data=error
 
-	# If EASYRSA_PKI exists, confirm before we rm -rf (skiped with EASYRSA_BATCH)
-	if [ -e "$EASYRSA_PKI" ]; then
-		confirm "Confirm removal: " "yes" "
-WARNING!!!
+		if remove_lock_file "$lock_file" "$lock_data"; then
+			verbose "lock-file REMOVED: $lock_file"
+		else
+			if [ "$lock_data" = error ]; then
+				error_description=READ
+			else
+				error_description=REMOVE
+			fi
+
+			# Print error message and set error code
+			print "\
+cleanup: Failed to ${error_description} lock-file!
+
+Please check that easyrsa is not being used by another process
+and then try running the easyrsa command again."
+			# Reserve exit-code 17 for lock-file error
+			easyrsa_exit_with_error=17
+		fi
+	else
+		verbose "lock-file does not exist."
+	fi
 
-You are about to remove the EASYRSA_PKI at: $EASYRSA_PKI
-and initialize a fresh PKI here."
-		# now remove it:
-		rm -rf "$EASYRSA_PKI" || die "Removal of PKI dir failed. Check/correct errors above"
+	# Exit: Known errors
+	# -> confirm(): aborted
+	# -> verify_cert(): verify failed --batch mode
+	# -> check_serial_unique(): not unique --batch mode
+	# -> user_error(): User errors but not die()
+	if [ "$easyrsa_exit_with_error" ]; then
+		verbose "Exit: Known errors = true ($easyrsa_exit_with_error)"
+		exit "$easyrsa_exit_with_error"
+	elif [ "$1" = 2 ]; then
+		verbose "exit SIGINT = true"
+		kill -2 "$$" # Exit: SIGINT
+	elif [ "$1" = ok ]; then
+		verbose "Exit: Final Success = true"
+		exit 0 # Exit: Final Success
 	fi
 
-	# new dirs:
-	for i in private reqs; do
-		mkdir -p "$EASYRSA_PKI/$i" || die "Failed to create PKI file structure (permissions?)"
-	done
+	# if 'cleanup' is called without 'ok' then an error occurred
+	print "*** Easy-RSA has encountered a FATAL error, please report this."
+	verbose "Exit: Final Fail = true"
+	exit 1 # Exit: Final Fail, unknown error
+} # => cleanup()
+
+# Escape hazardous characters
+# Auto-escape hazardous characters:
+# '&' - Workaround 'sed' behavior
+# '$' - Workaround 'easyrsa' based limitation
+# This is required for all SSL libs, otherwise,
+# there are unacceptable differences in behavior
+escape_hazard() {
+	# Assign temp-file
+	escape_hazard_tmp=""
+	easyrsa_mktemp escape_hazard_tmp
+
+	# write org fields to org temp-file and escape '&' and '$'
+	print "\
+export EASYRSA_REQ_COUNTRY=\"$EASYRSA_REQ_COUNTRY\"
+export EASYRSA_REQ_PROVINCE=\"$EASYRSA_REQ_PROVINCE\"
+export EASYRSA_REQ_CITY=\"$EASYRSA_REQ_CITY\"
+export EASYRSA_REQ_ORG=\"$EASYRSA_REQ_ORG\"
+export EASYRSA_REQ_OU=\"$EASYRSA_REQ_OU\"
+export EASYRSA_REQ_EMAIL=\"$EASYRSA_REQ_EMAIL\"
+export EASYRSA_REQ_SERIAL=\"$EASYRSA_REQ_SERIAL\"\
+" | sed -e s\`'\&'\`'\\\&'\`g \
+		-e s\`'\$'\`'\\\$'\`g > "$escape_hazard_tmp" || \
+			die "escape_hazard - Failed to write temp-file"
+
+	# Reload fields from fully escaped temp-file
+	# shellcheck disable=1090 # Non-constant source
+	. "$escape_hazard_tmp" || return 1
+	verbose "escape_hazard; COMPLETED"
+} # => escape_hazard()
+
+# Replace environment variable names with current value
+# and write to temp-file or return error from sed
+sed_expand_ssl_config() {
+	# Rewrite
+	# shellcheck disable=SC2016 # No expand ''
+	if sed \
+\
+-e s\`'$dir'\`\
+\""$EASYRSA_PKI"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_PKI'\`\
+\""$EASYRSA_PKI"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_CERT_EXPIRE'\`\
+\""$EASYRSA_CERT_EXPIRE"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_CRL_DAYS'\`\
+\""$EASYRSA_CRL_DAYS"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_DIGEST'\`\
+\""$EASYRSA_DIGEST"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_KEY_SIZE'\`\
+\""$EASYRSA_KEY_SIZE"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_DN'\`\
+\""$EASYRSA_DN"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_REQ_CN'\`\
+\""$EASYRSA_REQ_CN"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_REQ_COUNTRY'\`\
+\""$EASYRSA_REQ_COUNTRY"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_REQ_PROVINCE'\`\
+\""$EASYRSA_REQ_PROVINCE"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_REQ_CITY'\`\
+\""$EASYRSA_REQ_CITY"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_REQ_ORG'\`\
+\""$EASYRSA_REQ_ORG"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_REQ_OU'\`\
+\""$EASYRSA_REQ_OU"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_REQ_EMAIL'\`\
+\""$EASYRSA_REQ_EMAIL"\"\`g \
+\
+-e s\`'$ENV::EASYRSA_REQ_SERIAL'\`\
+\""$EASYRSA_REQ_SERIAL"\"\`g \
+\
+			"$1" > "$2"
+		then
+			verbose "sed_expand_ssl_config; via 'sed' COMPLETED"
+		else
+			return 1
+		fi
+} # => sed_expand_ssl_config()
 
-	notice "\
-init-pki complete; you may now create a CA or requests.
-Your newly created PKI dir is: $EASYRSA_PKI
-"
-	return 0
-} # => init_pki()
+# generate safe ssl config via here-doc or sed
+expand_safe_ssl_cnf() {
+	# check params
+	if [ -f "$1" ] && [ -f "$2" ]; then
+		: # ok
+	else
+		die "expand_safe_ssl_cnf - files"
+	fi
+
+	# is source file-hash known?
+	if ! check_ssl_cnf_known_hash "$1" || [ "$EASYRSA_FORCE_SAFE_SSL" ]
+	then
+		# expand via sed
+		# Use subshell to preserve cn_org values,
+		# otherwise they become double esaped
+		(
+			escape_hazard || return 1
+			sed_expand_ssl_config "$1" "$2" || return 1
+		) || die "expand_safe_ssl_cnf - subshell error"
+		verbose "expand_safe_ssl_cnf; expand via sed COMPLETED"
+	else
+		# write here-doc
+		write_legacy_file_v2 safe-cnf "$2" overwrite || \
+			die "expand_safe_ssl_cnf - write_legacy_file_v2 safe-cnf"
+		verbose "expand_safe_ssl_cnf; write safe-cnf here-doc COMPLETED"
+	fi
+} # => expand_safe_ssl_cnf()
+
+# Easy-RSA meta-wrapper for SSL
+# WARNING: Running easyrsa_openssl in a subshell
+# will hide error message and verbose messages
+easyrsa_openssl() {
+	openssl_command="$1"; shift
+
+	if [ "$EASYRSA_DEBUG" ]; then
+		verbose "easyrsa_openssl; BEGIN $openssl_command $*"
+	else
+		verbose "easyrsa_openssl; BEGIN $openssl_command"
+	fi
+
+	# Do not allow 'rand' here, see easyrsa_random()
+	case "$openssl_command" in
+		rand) die "easyrsa_openssl: Illegal SSL command: rand"
+	esac
+
+	# expand EASYRSA_SSL_CONF and export to OPENSSL_CONF
+	[ -f "$EASYRSA_SSL_CONF" ] || \
+			die "easyrsa_openssl - Missing EASYRSA_SSL_CONF"
+
+	if [ "$EASYRSA_FORCE_SAFE_SSL" ]; then
+		final_safe_ssl_cnf=
+		easyrsa_mktemp final_safe_ssl_cnf
+
+		expand_safe_ssl_cnf "$EASYRSA_SSL_CONF" "$final_safe_ssl_cnf" || \
+			die "easyrsa_openssl - expand_safe_ssl_cnf final_safe_ssl_cnf"
+
+		# export OPENSSL_CONF as new tmp-file
+		export OPENSSL_CONF="$final_safe_ssl_cnf"
+		verbose "easyrsa_openssl; OPENSSL_CONF (expanded) = $OPENSSL_CONF"
+	else
+		# use current EASYRSA_SSL_CONF and export to OPENSSL_CONF
+		export OPENSSL_CONF="$EASYRSA_SSL_CONF"
+		verbose "easyrsa_openssl; OPENSSL_CONF (original) = $OPENSSL_CONF"
+	fi
+
+	# Exec SSL
+	if [ "$EASYRSA_SILENT_SSL" ] && [ "$EASYRSA_BATCH" ]
+	then
+		if "$EASYRSA_OPENSSL" "$openssl_command" "$@" 2>/dev/null
+		then
+			verbose "easyrsa_openssl; END $openssl_command"
+			return
+		fi
+	else
+		if "$EASYRSA_OPENSSL" "$openssl_command" "$@"
+		then
+			verbose "easyrsa_openssl; END $openssl_command"
+			return
+		fi
+	fi
+
+	# Always fail here
+	die "\
+easyrsa_openssl - Command has failed:
+* $EASYRSA_OPENSSL $openssl_command $*"
+} # => easyrsa_openssl()
+
+# Verify the SSL library is functional
+# and establish version dependencies
+verify_ssl_lib() {
+	# Run once only
+	[ "$verify_ssl_lib_ok" ] && return
+	verify_ssl_lib_ok=1
+	unset -v openssl_v3
+
+	# redirect std-err, ignore missing ssl/openssl.cnf
+	val="$(
+			"$EASYRSA_OPENSSL" version 2>/dev/null
+		)"
+	ssl_version="$val"
+
+	# SSL lib name
+	case "${val%% *}" in
+		OpenSSL)
+			ssl_lib_name=openssl
+			;;
+		LibreSSL)
+			ssl_lib_name=libressl
+			export EASYRSA_FORCE_SAFE_SSL=1
+			;;
+		*)
+			error_msg="$("$EASYRSA_OPENSSL" version 2>&1)"
+			user_error "\
+* OpenSSL must either exist in your PATH
+  or be defined in your vars file.
+
+Invalid SSL output for 'version':
+
+$error_msg"
+	esac
+
+	# Set SSL version dependent $no_password option
+	osslv_major="${val#* }"
+	osslv_major="${osslv_major%%.*}"
+	case "$osslv_major" in
+		1) no_password='-nodes' ;;
+		2) no_password='-nodes' ;;
+		3|4)
+			case "$ssl_lib_name" in
+				openssl)
+					openssl_v3=1
+					no_password='-noenc'
+					;;
+				libressl)
+					no_password='-nodes'
+					;;
+				*) die "Unexpected SSL library: $ssl_lib_name"
+			esac
+			;;
+		*) die "Unexpected SSL version: $osslv_major"
+	esac
+
+	# Message
+	verbose "verify_ssl_lib; $ssl_version ($EASYRSA_OPENSSL)"
+} # => verify_ssl_lib()
+
+# Basic sanity-check of PKI init and complain if missing
+verify_pki_init() {
+	help_note="\
+Run easyrsa without commands for usage and command help."
+
+	# Check for defined EASYRSA_PKI
+	[ "$EASYRSA_PKI" ] || die "\
+EASYRSA_PKI env-var undefined"
+
+	# check that the pki dir exists
+	[ -d "$EASYRSA_PKI" ] || user_error "\
+EASYRSA_PKI does not exist (perhaps you need to run init-pki)?
+Expected to find the EASYRSA_PKI at:
+* $EASYRSA_PKI
+
+$help_note"
+
+	# verify expected dirs present:
+	for i in private reqs; do
+		[ -d "$EASYRSA_PKI/$i" ] || user_error "\
+Missing expected directory: $i
+
+(perhaps you need to run init-pki?)
+
+$help_note"
+	done
+	unset -v help_note
+} # => verify_pki_init()
+
+# Verify core CA files present
+verify_ca_init() {
+	verify_ca_help_note="\
+Run easyrsa without commands for usage and command help."
+
+	# Verify expected files are present.
+	# Allow files to be regular files (or symlinks),
+	# but also pipes, for flexibility with ca.key
+	for i in ca.crt private/ca.key index.txt serial; do
+		if [ ! -f "$EASYRSA_PKI/$i" ] && \
+			[ ! -p "$EASYRSA_PKI/$i" ]
+		then
+			# Used by usage() and export-p12/p7
+			[ "$1" = "test" ] && return 1
+
+			user_error "\
+Missing expected CA file: $i
+
+(perhaps you need to run build-ca?)
+
+$verify_ca_help_note"
+		fi
+	done
+
+	# When operating in 'test' mode, return success.
+	# test callers don't care about CA-specific dir structure
+	[ "$1" = "test" ] && return 0
+
+	# verify expected CA-specific dirs:
+	for i in issued certs_by_serial; do
+		[ -d "$EASYRSA_PKI/$i" ] || user_error "\
+Missing expected CA dir: $i
+
+(perhaps you need to run build-ca?)
+
+$verify_ca_help_note"
+	done
+} # => verify_ca_init()
+
+# init-pki backend:
+init_pki() {
+	verbose "BEGIN: algo: '$EASYRSA_ALGO' | curve: '$EASYRSA_CURVE'"
+
+	# Parse options for algo/curve - overwrite defaults
+	while [ "$1" ]; do
+		case "$1" in
+			rsa)
+				export EASYRSA_ALGO="$1"
+				unset -v EASYRSA_CURVE
+			;;
+			ec)
+				export EASYRSA_ALGO="$1"
+				export EASYRSA_CURVE=secp384r1
+			;;
+			ed)
+				export EASYRSA_ALGO="$1"
+				export EASYRSA_CURVE=ed25519
+			;;
+			*)
+				export EASYRSA_CURVE="$1"
+				case "$EASYRSA_CURVE" in
+					ed*) export EASYRSA_ALGO=ed ;;
+					*) export EASYRSA_ALGO=ec
+				esac
+		esac
+		shift
+	done
+
+	# Set default curve based on algo
+	case "$EASYRSA_ALGO" in
+		rsa) : ;; # ok
+		ec) set_var EASYRSA_CURVE secp384r1 ;;
+		ed) set_var EASYRSA_CURVE ed25519 ;;
+		*) die "Unknown EASYRSA_ALGO: '$EASYRSA_ALGO'"
+	esac
+
+	# Set default algo based on curve
+	case "$EASYRSA_CURVE" in
+		'') : ;; # ok
+		ed*) set_var EASYRSA_ALGO ed ;;
+		*) set_var EASYRSA_ALGO ec
+	esac
+
+	# Verify user settings
+	verbose "TRY: Algo: '$EASYRSA_ALGO' - Curve: '$EASYRSA_CURVE'"
+	verify_algo_params
+
+	# EasyRSA will NOT do 'rm -rf /'
+	case "$EASYRSA_PKI" in
+		.|..|./|../|.//*|..//*|/|//*|\\|?:|'')
+			user_error "Invalid PKI: $EASYRSA_PKI"
+	esac
+
+	#  Auto-configuration $pki/vars for ec/ed
+	case "$EASYRSA_ALGO" in
+		rsa) auto_algo= ;; # ok
+		ec) auto_algo="Auto-configured for Elliptic curve '$EASYRSA_CURVE'" ;;
+		ed) auto_algo="Auto-configured for Edwards curve '$EASYRSA_CURVE'" ;;
+		*) die "Auto-configuration, Unknown EASYRSA_ALGO: '$EASYRSA_ALGO'"
+	esac
+
+	# If EASYRSA_PKI exists, confirm before deletion
+	if [ -d "$EASYRSA_PKI" ]; then
+		confirm "Confirm removal: " "yes" "
+WARNING!!!
+
+You are about to remove the EASYRSA_PKI at:
+* $EASYRSA_PKI
+
+and initialize a fresh PKI here. $auto_algo"
+
+		# Remove existing PKI
+		rm -rf "$EASYRSA_PKI" || \
+			die "Failed to remove existing PKI: '$EASYRSA_PKI'"
+	fi
+
+	# new dirs:
+	for i in issued private reqs; do
+		mkdir -p "${EASYRSA_PKI}/${i}" || \
+			die "init_pki() - Failed to create '$i' directory."
+	done
+
+	# write pki/vars.example - no temp-file because no session
+	write_legacy_file_v2 vars "$EASYRSA_PKI"/vars.example || \
+		die "init_pki() - Failed to create vars.example"
+
+	#  Auto-configuration $pki/vars for ec/ed
+	case "$EASYRSA_ALGO" in
+	ec|ed)
+		# sed search and replace regex
+		s_alg='#set_var[[:blank:]]*EASYRSA_ALGO[[:blank:]]*rsa'
+		r_alg="set_var EASYRSA_ALGO $EASYRSA_ALGO   # -->  $auto_algo"
+		s_crv='#set_var[[:blank:]]*EASYRSA_CURVE[[:blank:]]*secp384r1'
+		r_crv="set_var EASYRSA_CURVE $EASYRSA_CURVE   # -->  $auto_algo"
+
+		# Create Auto-configured vars file
+		# Note: pki/vars.example is Always created by Easy-RSA above
+		sed -e s/"$s_alg"/"$r_alg"/ -e s/"$s_crv"/"$r_crv"/ \
+			"$EASYRSA_PKI"/vars.example > "$EASYRSA_PKI"/vars || \
+				die "sed auto-vars"
+	esac
+
+	# User notice
+	notice "\
+'init-pki' complete; you may now create a CA or requests.
+
+Your newly created PKI dir is:
+* $EASYRSA_PKI"
+
+	# Select and show Auto-configured vars file
+	unset -v EASYRSA_NO_VARS EASYRSA_VARS_FILE
+
+	if select_vars; then
+		information "\
+IMPORTANT: PKI algorithm is $auto_algo${NL}
+Using Easy-RSA Auto-configured 'vars' file:
+* ${EASYRSA_VARS_FILE}${NL}"
+	fi
+} # => init_pki()
+
+# Find support files from various sources
+# Declare in preferred order, first wins
+# beaten by command line.
+# If these files are not found here then they
+# will be built on-demand by the selected command.
+locate_support_files() {
+	# Set required sources
+	ssl_cnf_file='openssl-easyrsa.cnf'
+	x509_types_dir='x509-types'
+
+	# Find data-files
+	for area in \
+		"$EASYRSA_PKI" \
+		"$EASYRSA" \
+		"$PWD" \
+		"${0%/*}" \
+		'/usr/local/share/easy-rsa' \
+		'/usr/share/easy-rsa' \
+		'/etc/easy-rsa' \
+		# EOL
+	do
+		# Find x509-types
+		if [ -d "${area}/${x509_types_dir}" ]; then
+			set_var EASYRSA_EXT_DIR "${area}/${x509_types_dir}"
+		fi
+
+		# Find openssl-easyrsa.cnf
+		if [ -f "${area}/${ssl_cnf_file}" ]; then
+			set_var EASYRSA_SSL_CONF "${area}/${ssl_cnf_file}"
+		fi
+	done
+
+	verbose "\
+locate_support_files; EASYRSA_EXT_DIR: ${EASYRSA_EXT_DIR:-built-in}"
+	verbose "\
+locate_support_files; EASYRSA_SSL_CONF: ${EASYRSA_SSL_CONF:-built-in}"
+} # => locate_support_files()
+
+# Disable terminal echo, if possible, otherwise warn
+hide_read_pass() {
+	# 3040 - In POSIX sh, set option [name] is undefined
+	# 3045 - In POSIX sh, some-command-with-flag is undefined
+	# 3061 - In POSIX sh, read without a variable is undefined.
+	# shellcheck disable=SC3040,SC3045,SC3061
+	if stty -echo 2>/dev/null; then
+		prompt_restore=1
+		read -r "$@"
+		stty echo
+	elif (set +o echo 2>/dev/null); then
+		prompt_restore=2
+		set +o echo
+		read -r "$@"
+		set -o echo
+	elif (echo | read -r -s 2>/dev/null) ; then
+		read -r -s "$@"
+	else
+		warn "\
+Could not disable echo. Password will be shown on screen!"
+		read -r "$@"
+	fi
+	prompt_restore=0
+} # => hide_read_pass()
+
+# Get passphrase
+get_passphrase() {
+	while :; do
+		r=""
+		printf '\n%s' "$2"
+		hide_read_pass r
+
+		if [ "${#r}" -lt 4 ]; then
+			printf '\n%s\n' \
+				"Passphrase must be at least 4 characters!"
+		else
+			printf '%s' "$r" > "$1" || die "get_passphrase() malfunction"
+			print
+			return 0
+		fi
+	done
+	return 1
+} # => get_passphrase()
 
 # build-ca backend:
 build_ca() {
-	local opts= sub_ca=
-	while [ -n "$1" ]; do
+	# Only allow if peer-fingerprint mode file does not exist
+	if [ -f "$EASYRSA_PKI"/peer-fp.mode ]; then
+		user_error "Cannot create CA in a peer-fingerprint PKI"
+	fi
+
+	cipher="-aes256"
+	unset -v sub_ca date_stamp x509 error_info \
+		ca_password_via_cmdline
+
+	while [ "$1" ]; do
 		case "$1" in
-			nopass) opts="$opts -nodes" ;;
-			subca) sub_ca=1 ;;
-			*) warn "Ignoring unknown command option: '$1'" ;;
+			intca|subca)
+				sub_ca=1
+				;;
+			nopass)
+				[ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1
+				;;
+			rawca)
+				# option --raw-ca demands user interaction
+				# which forbids --batch
+				[ "$EASYRSA_BATCH" ] && user_error \
+					"--raw-ca is incompatible with --batch"
+				EASYRSA_RAW_CA=1
+				;;
+			*) user_error "Unknown command option: '$1'"
 		esac
 		shift
 	done
 
-	verify_pki_init
-	[ "$EASYRSA_ALGO" = "ec" ] && verify_curve
-
-	# setup for the simpler sub-CA situation and overwrite with root-CA if needed:
-	local out_file="$EASYRSA_PKI/reqs/ca.req"
-	local out_key="$EASYRSA_PKI/private/ca.key"
-	if [ ! $sub_ca ]; then
+	out_key="$EASYRSA_PKI/private/ca.key"
+	# setup for an intermediate CA
+	if [ "$sub_ca" ]; then
+		# Generate a CSR
+		out_file="$EASYRSA_PKI/reqs/ca.req"
+	else
+		# Generate a certificate
 		out_file="$EASYRSA_PKI/ca.crt"
-		opts="$opts -x509 -days $EASYRSA_CA_EXPIRE"
+		date_stamp=1
+		x509=1
+	fi
+
+	# RAW mode must take priority
+	if [ "$EASYRSA_RAW_CA" ]; then
+		unset -v EASYRSA_NO_PASS EASYRSA_PASSOUT EASYRSA_PASSIN
+		verbose "CA password RAW method"
+	else
+		# If encrypted then create the CA key with AES256 cipher
+		if [ "$EASYRSA_NO_PASS" ]; then
+			unset -v cipher
+		else
+			unset -v no_password
+		fi
 	fi
 
 	# Test for existing CA, and complain if already present
 	if verify_ca_init test; then
-		die "\
+		user_error "\
 Unable to create a CA as you already seem to have one set up.
 If you intended to start a new CA, run init-pki first."
 	fi
-	# If a private key exists here, a sub-ca was created but not signed.
-	# Notify the user and require a signed ca.crt or a init-pki:
-	[ -f "$out_key" ] && \
+
+	# If a private key exists, an intermediate ca was created
+	# but not signed.
+	# Notify user and require a signed ca.crt or a init-pki:
+	if [ -f "$out_key" ]; then
+		user_error "\
+A CA private key exists but no ca.crt is found in your PKI:
+* $EASYRSA_PKI
+
+Refusing to create a new CA as this would overwrite your
+current CA. To start a new CA, run init-pki first."
+	fi
+
+	# create necessary dirs:
+	mkdir -p \
+		"${EASYRSA_PKI}"/certs_by_serial \
+		"${EASYRSA_PKI}"/revoked/certs_by_serial \
+		"${EASYRSA_PKI}"/revoked/private_by_serial || \
+			die "build_ca() - Failed to create PKI sub-directories."
+
+	# create necessary files:
+	err_msg="\
+Unable to create necessary PKI files (permissions?)"
+
+	printf "" > \
+		"$EASYRSA_PKI/index.txt" || die "$err_msg"
+	printf '%s\n' "01" \
+		> "$EASYRSA_PKI/serial" || die "$err_msg"
+	unset -v err_msg
+
+	# Set ssl batch mode, as required
+	[ "$EASYRSA_BATCH" ] && ssl_batch=1
+
+	# Default CA commonName
+	if [ "$EASYRSA_REQ_CN" = ChangeMe ]; then
+		if [ "$sub_ca" ]; then
+			export EASYRSA_REQ_CN="Easy-RSA Sub-CA"
+		else
+			export EASYRSA_REQ_CN="Easy-RSA CA"
+		fi
+	fi
+
+	# Assign cert and key temp files
+	out_key_tmp=""
+	easyrsa_mktemp out_key_tmp
+	out_file_tmp=""
+	easyrsa_mktemp out_file_tmp
+
+	# Get passphrase from user if necessary
+	if [ "$EASYRSA_RAW_CA" ]
+	then
+		# Passphrase will be provided
+		confirm "
+       Accept ?  " yes "\
+Raw CA mode
+===========
+
+  CA password must be input THREE times:
+
+    1. Set the password.
+    2. Confirm the password.
+    3. Use the password. (Create the Root CA)"
+
+	elif [ "$EASYRSA_NO_PASS" ]
+	then
+		: # No passphrase required
+
+	elif [ "$EASYRSA_PASSOUT" ] && [ "$EASYRSA_PASSIN" ]
+	then
+		# passphrase defined on command line
+		# Both --passout and --passin
+		# must be defined for a CA with a password
+		ca_password_via_cmdline=1
+
+	else
+		# Get passphrase p
+		in_key_pass_tmp=
+		easyrsa_mktemp in_key_pass_tmp
+		get_passphrase "$in_key_pass_tmp" \
+			"Enter New CA Key Passphrase: " || \
+				die "get_passphrase in failed."
+
+		# Confirm passphrase q
+		out_key_pass_tmp=
+		easyrsa_mktemp out_key_pass_tmp
+		get_passphrase "$out_key_pass_tmp" \
+			"Confirm New CA Key Passphrase: " || \
+				die "get_passphrase out failed."
+
+		# Validate passphrase
+		p="$(cat "$in_key_pass_tmp")" || die "passphrase in malfunction"
+		q="$(cat "$out_key_pass_tmp")" || die "passphrase out malfunction"
+		if [ "$p" = "$q" ]; then
+			# Clear possible conflicts and use temp-files not vars
+			unset -v EASYRSA_PASSOUT EASYRSA_PASSIN p q r
+		else
+			user_error "Passphrase mismatch!"
+		fi
+	fi
+
+	# Find or create x509 CA file
+	# Note: $new_x509_type_file_tmp is non-local
+	# set by select_x509_type_tmp()
+	select_x509_type_tmp ca
+	x509_type_tmp_file_ca="$new_x509_type_file_tmp"
+	verbose "x509_type_tmp_file_ca = '$x509_type_tmp_file_ca'"
+
+	# keyUsage critical
+	if [ "$EASYRSA_KU_CRIT" ]; then
+		add_critical_attrib keyUsage \
+			"$x509_type_tmp_file_ca" x509_type_tmp_file_ca || \
+				die "build-ca - add_critical_attrib kU"
+		verbose "keyUsage critical OK"
+	fi
+
+	# basicConstraints critical
+	if [ "$EASYRSA_BC_CRIT" ]; then
+		add_critical_attrib basicConstraints \
+			"$x509_type_tmp_file_ca" x509_type_tmp_file_ca || \
+				die "build-ca - add_critical_attrib bC"
+		verbose "basicConstraints critical OK"
+	fi
+
+	# Find or create x509 COMMON file
+	select_x509_type_tmp COMMON
+	x509_type_tmp_file_COMMON="$new_x509_type_file_tmp"
+	verbose "x509_type_tmp_file_COMMON = '$x509_type_tmp_file_COMMON'"
+
+	# Check for insert-marker in ssl config file
+	if ! grep -q '^#%CA_X509_TYPES_EXTRA_EXTS%' \
+		"$EASYRSA_SSL_CONF"
+	then
 		die "\
-A CA private key exists but no ca.crt is found in your PKI dir of:
-$EASYRSA_PKI
-Refusing to create a new CA keypair as this operation would overwrite your
-current CA keypair. If you intended to start a new CA, run init-pki first."
+This openssl config file does not support X509-type 'ca'.
+* $EASYRSA_SSL_CONF
 
-	# create necessary files and dirs:
-	local err_file="Unable to create necessary PKI files (permissions?)"
-	for i in issued certs_by_serial; do
-		mkdir -p "$EASYRSA_PKI/$i" || die "$err_file"
-	done
-	printf "" > "$EASYRSA_PKI/index.txt" || die "$err_file"
-	print "01" > "$EASYRSA_PKI/serial" || die "$err_file"
+Please update 'openssl-easyrsa.cnf' to the latest Easy-RSA release."
+	fi
+
+	# Assign awkscript to insert EASYRSA_EXTRA_EXTS
+	# shellcheck disable=SC2016 # No expand '' - build_ca()
+	awkscript='\
+{if ( match($0, "^#%CA_X509_TYPES_EXTRA_EXTS%") )
+{ while ( getline<"/dev/stdin" ) {print} next }
+{print}
+}'
 
-	# Default CN only when not in global EASYRSA_BATCH mode:
-	[ $EASYRSA_BATCH ] && opts="$opts -batch" || export EASYRSA_REQ_CN="Easy-RSA CA"
+	# Assign tmp-file for config
+	adjusted_ssl_cnf_tmp=""
+	easyrsa_mktemp adjusted_ssl_cnf_tmp
+
+	# Insert x509-types COMMON and 'ca' and EASYRSA_EXTRA_EXTS
+	{
+		# X509 files
+		cat "$x509_type_tmp_file_ca" "$x509_type_tmp_file_COMMON"
+
+		# User extensions
+		[ "$EASYRSA_EXTRA_EXTS" ] && \
+			print "$EASYRSA_EXTRA_EXTS"
+
+	} | awk "$awkscript" "$EASYRSA_SSL_CONF" \
+			> "$adjusted_ssl_cnf_tmp" || \
+				die "Copying X509_TYPES to config file failed"
+	verbose "Insert x509 and extensions OK"
+
+	# Use this new SSL config for the rest of this function
+	export EASYRSA_SSL_CONF="$adjusted_ssl_cnf_tmp"
+
+	# Generate CA Key
+	case "$EASYRSA_ALGO" in
+	rsa)
+	easyrsa_openssl genpkey \
+		-algorithm "$EASYRSA_ALGO" \
+		-pkeyopt rsa_keygen_bits:"$EASYRSA_ALGO_PARAMS" \
+		-out "$out_key_tmp" \
+		${cipher:+ "$cipher"} \
+		${EASYRSA_PASSOUT:+ -pass "$EASYRSA_PASSOUT"} \
+		${out_key_pass_tmp:+ -pass file:"$out_key_pass_tmp"} \
+			|| die "Failed create CA private key"
+	;;
+	ec)
+	easyrsa_openssl genpkey \
+		-paramfile "$EASYRSA_ALGO_PARAMS" \
+		-out "$out_key_tmp" \
+		${cipher:+ "$cipher"} \
+		${EASYRSA_PASSOUT:+ -pass "$EASYRSA_PASSOUT"} \
+		${out_key_pass_tmp:+ -pass file:"$out_key_pass_tmp"} \
+			|| die "Failed create CA private key"
+	;;
+	ed)
+	easyrsa_openssl genpkey \
+		-algorithm "$EASYRSA_CURVE" \
+		-out "$out_key_tmp" \
+		${cipher:+ "$cipher"} \
+		${EASYRSA_PASSOUT:+ -pass "$EASYRSA_PASSOUT"} \
+		${out_key_pass_tmp:+ -pass file:"$out_key_pass_tmp"} \
+			|| die "Failed create CA private key"
+	;;
+	*) die "Unknown algorithm: $EASYRSA_ALGO"
+	esac
+
+	# verbose notice
+	if [ "$EASYRSA_RAW_CA" ]; then
+		verbose "CA key password created via RAW"
+	elif [ "$ca_password_via_cmdline" ]; then
+		verbose "CA key password created via command options"
+	elif [ "$EASYRSA_NO_PASS" ]; then
+		verbose "CA key has no password"
+	else
+		verbose "CA key pass created via temp-files"
+	fi
 
-	out_key_tmp="$(mktemp -u "$out_key.XXXXXXXXXX")"; EASYRSA_TEMP_FILE_2="$out_key_tmp"
-	out_file_tmp="$(mktemp -u "$out_file.XXXXXXXXXX")"; EASYRSA_TEMP_FILE_3="$out_file_tmp"
-	# create the CA keypair:
-	"$EASYRSA_OPENSSL" req -utf8 -new -newkey $EASYRSA_ALGO:"$EASYRSA_ALGO_PARAMS" \
-		-config "$EASYRSA_SSL_CONF" -keyout "$out_key_tmp" -out "$out_file_tmp" $opts || \
-		die "Failed to build the CA"
-	mv "$out_key_tmp" "$out_key"; EASYRSA_TEMP_FILE_2=
-	mv "$out_file_tmp" "$out_file"; EASYRSA_TEMP_FILE_3=
+	# Generate the CA keypair:
+	easyrsa_openssl req -utf8 -new \
+		-key "$out_key_tmp" \
+		-out "$out_file_tmp" \
+		${ssl_batch:+ -batch} \
+		${x509:+ -x509} \
+		${EASYRSA_TEXT_ON:+ -text} \
+		${date_stamp:+ -days "$EASYRSA_CA_EXPIRE"} \
+		${EASYRSA_DIGEST:+ -"$EASYRSA_DIGEST"} \
+		${EASYRSA_NO_PASS:+ "$no_password"} \
+		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+		${EASYRSA_PASSOUT:+ -passout "$EASYRSA_PASSOUT"} \
+		${in_key_pass_tmp:+ -passin file:"$in_key_pass_tmp"} \
+		${out_key_pass_tmp:+ -passout file:"$out_key_pass_tmp"} \
+			|| die "Failed to build the CA keypair"
+
+	# Move temp-files to target-files
+	mv "$out_key_tmp" "$out_key" || mv_temp_error=1
+	mv "$out_file_tmp" "$out_file" || mv_temp_error=1
+	if [ "$mv_temp_error" ]; then
+		rm -f "$out_key" "$out_file"
+		die "Failed to move new CA files."
+	fi
 
 	# Success messages
-	if [ $sub_ca ]; then
+	if [ "$sub_ca" ]; then
 		notice "\
-NOTE: Your sub-CA request is at $out_file
-and now must be sent to you parent CA for signing. Place your resulting cert
-at $EASYRSA_PKI/ca.crt prior to signing operations.
-"
-	else	notice "\
-CA creation complete and you may now import and sign cert requests.
-Your new CA certificate file for publishing is at:
-$out_file
-"
+Your intermediate CA request is at:
+* $out_file
+  and now must be sent to your parent CA for signing.
+
+Prior to signing operations, place your resulting Sub-CA cert at:
+* $EASYRSA_PKI/ca.crt"
+	else
+		notice "\
+CA creation complete. Your new CA certificate is at:
+* $out_file
+
+Build-ca completed successfully."
 	fi
-	return 0
 } # => build_ca()
 
+# Build self signed key pair
+self_sign() {
+	# Only allow if CA does not exist
+	if [ -f "$EASYRSA_PKI"/ca.crt ] || \
+		[ -f "$EASYRSA_PKI"/private/ca.key ]
+	then
+		user_error "Cannot create self-signed certificate in a CA."
+	fi
+
+	# Define x509 type
+	case "$1" in
+		server)
+			selfsign_eku=serverAuth
+			crt_type=self-signed-server
+			;;
+		client)
+			selfsign_eku=clientAuth
+			crt_type=self-signed-client
+			;;
+		*)
+			die "self_sign: Unknown EKU '$1'"
+	esac
+	shift
+
+	# pull $file_name_base
+	[ "$1" ] || user_error "\
+Error: didn't find a file base name as the first argument.
+Run easyrsa without commands for usage and command help."
+
+	file_name_base="$1"
+	shift
+
+	# Prohibit --req-cn
+	[ "$EASYRSA_REQ_CN" = ChangeMe ] || user_error "\
+Option conflict --req-cn:
+* '$cmd' does not support setting an external commonName"
+
+	# Enforce commonName
+	export EASYRSA_REQ_CN="$file_name_base"
+
+	# Refuse option as name
+	case "$file_name_base" in
+		nopass)
+			user_error "Refusing '$file_name_base' as name."
+	esac
+
+	# function opts support
+	while [ "$1" ]; do
+		case "$1" in
+			nopass)
+				[ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1
+				;;
+			*)
+				user_error "Unknown command option: '$1'"
+		esac
+		shift
+	done
+
+	# Assign output files
+	key_out="$EASYRSA_PKI/private/${file_name_base}.key"
+	crt_out="$EASYRSA_PKI/issued/${file_name_base}.crt"
+	inline_out="$EASYRSA_PKI/inline/${file_name_base}.inline"
+
+	# key file must NOT exist
+	[ -f "$key_out" ] && user_error "\
+Cannot self-sign this request for '$file_name_base'.
+Conflicting key exists at:
+* $key_out"
+
+	# Certificate file must NOT exist
+	[ -f "$crt_out" ] && user_error "\
+Cannot self-sign this request for '$file_name_base'.
+Conflicting certificate exists at:
+* $crt_out"
+
+	# Check algo and curve
+	case "$EASYRSA_ALGO" in
+		rsa|ec)
+			# Silently use ec instead of rsa
+			export EASYRSA_ALGO=ec
+			# Selectively set --curve=secp384r1
+			set_var EASYRSA_CURVE secp384r1
+
+			# temp-file for params-file
+			selfsign_params_file=""
+			easyrsa_mktemp selfsign_params_file
+
+			# params-file
+			"$EASYRSA_OPENSSL" ecparam \
+				-name "$EASYRSA_CURVE" \
+				-out "$selfsign_params_file" || \
+					die "self_sign - params-file failed"
+
+			# OpenSSL for Windows cannot load bash style file name
+			# as the -newkey "$newkey_params"
+			# eg:      -newkey ec:/c/Users/me/foo.txt
+			# becomes: -newkey ec:/Users/me/foo.txt
+			if [ "$OS" = Windows_NT ]; then
+				selfsign_params_file="${selfsign_params_file#/?}"
+				verbose "selfsign_params_file: $selfsign_params_file"
+			fi
+
+			newkey_params="$EASYRSA_ALGO":"$selfsign_params_file"
+			;;
+		ed)
+			# Selectively set --curve=ed25519
+			set_var EASYRSA_CURVE ed25519
+			newkey_params="$EASYRSA_CURVE"
+			;;
+		*)
+			user_error "Unrecognised algorithm: '$EASYRSA_ALGO'"
+	esac
+	verbose "Use ALGO:'$EASYRSA_ALGO' / CURVE:'$EASYRSA_CURVE'"
+
+	# Assign tmp-file for config
+	adjusted_ssl_cnf_tmp=""
+	easyrsa_mktemp adjusted_ssl_cnf_tmp
+
+	# Assign awkscript to insert EASYRSA_EXTRA_EXTS
+	# shellcheck disable=SC2016 # No expand '' - build_ca()
+	awkscript='\
+{if ( match($0, "^#%CA_X509_TYPES_EXTRA_EXTS%") )
+	{ while ( getline<"/dev/stdin" ) {print} next }
+ {print}
+}'
+
+	# create X509 'selfsign' temp-file, Only allowed internally
+	write_x509_type_tmp selfsign batch
+	x509_selfsign_file="$write_x509_file_tmp"
+
+	# Insert x509-type 'selfsign' and EASYRSA_EXTRA_EXTS
+	{
+		cat "$x509_selfsign_file"
+		[ "$EASYRSA_EXTRA_EXTS" ] && print "$EASYRSA_EXTRA_EXTS"
+	} | awk "$awkscript" "$EASYRSA_SSL_CONF" \
+			> "$adjusted_ssl_cnf_tmp" || \
+				die "Copying X509_TYPES to config file failed"
+	verbose "Insert x509 and extensions OK"
+
+	# Use this new SSL config for the rest of this function
+	export EASYRSA_SSL_CONF="$adjusted_ssl_cnf_tmp"
+
+	# Create temp-files for output
+	tmp_key_out=""
+	easyrsa_mktemp tmp_key_out
+
+	tmp_crt_out=""
+	easyrsa_mktemp tmp_crt_out
+
+	# create self-signed key pair
+	easyrsa_openssl req -x509 -utf8 -sha256 -text \
+		-newkey "$newkey_params" \
+		-keyout "$tmp_key_out" \
+		-out "$tmp_crt_out" \
+		${EASYRSA_BATCH:+ -batch} \
+		${EASYRSA_TEXT_ON:+ -text} \
+		${EASYRSA_NO_PASS:+ "$no_password"} \
+		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+		${EASYRSA_PASSOUT:+ -passout "$EASYRSA_PASSOUT"} \
+		${EASYRSA_CERT_EXPIRE:+ -days "$EASYRSA_CERT_EXPIRE"} \
+		${EASYRSA_START_DATE:+ -startdate "$EASYRSA_START_DATE"} \
+		${EASYRSA_END_DATE:+ -enddate "$EASYRSA_END_DATE"}
+
+	# Move temp-files to target-files
+	mv "$tmp_key_out" "$key_out" || mv_temp_error=1
+	mv "$tmp_crt_out" "$crt_out" || mv_temp_error=1
+	if [ "$mv_temp_error" ]; then
+		rm -f "$key_out" "$crt_out"
+		die "Failed to move new key/cert files."
+	fi
+
+	# inline key/cert/fingerprint
+	inline_file pfp "$file_name_base"
+
+	# Mark PKI as self-signed only
+	pfp_data='# Easy-RSA peer-fp-mode - Please DO NOT DELETE this file'
+	print "$pfp_data" > "$EASYRSA_PKI"/peer-fp.mode || \
+		die "Failed to setup peer-fingerprint mode."
+
+	# User info
+	notice "\
+Self-signed '$EASYRSA_ALGO/$EASYRSA_CURVE' \
+key and certificate created:
+* $key_out
+* $crt_out"
+} # => self_sign()
+
 # gen-dh backend:
 gen_dh() {
-	verify_pki_init
+	out_file="$EASYRSA_PKI/dh.pem"
+
+	# check to see if we already have a dh parameters file
+	if [ -f "$out_file" ]; then
+		if [ "$EASYRSA_BATCH" ]; then
+			# if batch is enabled, die
+			user_error "\
+DH parameters file already exists
+at: $out_file"
+		else
+			# warn the user, allow to force overwrite
+			confirm "Overwrite?  " "yes" "\
+DH parameters file already exists
+at: $out_file"
+		fi
+	fi
 
-	local out_file="$EASYRSA_PKI/dh.pem"
-	"$EASYRSA_OPENSSL" dhparam -out "$out_file" $EASYRSA_KEY_SIZE || \
-		die "Failed to build DH params"
-	notice "\
-DH parameters of size $EASYRSA_KEY_SIZE created at $out_file
-"
-	return 0
+	# Create a temp file
+	# otherwise user abort leaves an incomplete dh.pem
+	tmp_dh_file=""
+	easyrsa_mktemp tmp_dh_file
+
+	# Generate dh.pem
+	easyrsa_openssl dhparam -out "$tmp_dh_file" \
+		"$EASYRSA_KEY_SIZE" || die "Failed to generate DH params"
+
+	# Validate dh.pem
+	easyrsa_openssl dhparam -in "$tmp_dh_file" \
+		-check -noout || die "Failed to validate DH params"
+
+	# Move temp-files to target-files
+	mv "$tmp_dh_file" "$out_file" || mv_temp_error=1
+	if [ "$mv_temp_error" ]; then
+		rm -f "$out_file"
+		die "Failed to move temp DH file."
+	fi
+
+	notice "
+DH parameters of size $EASYRSA_KEY_SIZE created at:
+* $out_file"
 } # => gen_dh()
 
-# gen-req backend:
+# gen-req and key backend:
 gen_req() {
-	# pull filename base and use as default interactive CommonName:
-	[ -n "$1" ] || die "\
-Error: gen-req must have a file base as the first argument.
+	# pull filename, use as default interactive CommonName
+	[ "$1" ] || user_error "\
+Error: gen-req must have a file-name-base as the first argument.
 Run easyrsa without commands for usage and commands."
-	local key_out="$EASYRSA_PKI/private/$1.key"
-	local req_out="$EASYRSA_PKI/reqs/$1.req"
-	[ ! $EASYRSA_BATCH ] && EASYRSA_REQ_CN="$1"
-	shift
+
+	file_name_base="$1"
+	shift # scrape off file-name-base
+
+	# Set ssl batch mode as required
+	[ "$EASYRSA_BATCH" ] && ssl_batch=1
+
+	# Set commonName
+	if [ "$EASYRSA_REQ_CN" = ChangeMe ]; then
+		export EASYRSA_REQ_CN="$file_name_base"
+	fi
+
+	# Output files
+	key_out="$EASYRSA_PKI/private/${file_name_base}.key"
+	req_out="$EASYRSA_PKI/reqs/${file_name_base}.req"
 
 	# function opts support
-	local opts=
-	while [ -n "$1" ]; do
+	while [ "$1" ]; do
 		case "$1" in
-			nopass) opts="$opts -nodes" ;;
-			# batch flag supports internal callers needing silent operation
-			batch) local EASYRSA_BATCH=1 ;;
-			*) warn "Ignoring unknown command option: '$1'" ;;
+			text)
+				text=1
+				;;
+			nopass)
+				[ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1
+				;;
+			# batch flag supports internal caller build_full()
+			batch)
+				ssl_batch=1
+				;;
+			*) user_error "Unknown command option: '$1'"
 		esac
 		shift
 	done
 
-	verify_pki_init
-	[ "$EASYRSA_ALGO" = "ec" ] && verify_curve
+	# don't wipe out an existing request without confirmation
+	[ -f "$req_out" ] && confirm "Confirm request overwrite: " "yes" "\
+
+WARNING!!!
+
+An existing request file was found at
+* $req_out
+
+Continuing with key generation will replace this request."
 
 	# don't wipe out an existing private key without confirmation
 	[ -f "$key_out" ] && confirm "Confirm key overwrite: " "yes" "\
 
 WARNING!!!
 
-An existing private key was found at $key_out
+An existing private key was found at
+* $key_out
+
 Continuing with key generation will replace this key."
 
-	# When EASYRSA_EXTRA_EXTS is defined, append it to openssl's [req] section:
-	if [ -n "$EASYRSA_EXTRA_EXTS" ]; then
-		# Setup & insert the extra ext data keyed by a magic line
-		local extra_exts="
+	# When EASYRSA_EXTRA_EXTS is defined,
+	# append it to openssl's [req] section:
+	if [ "$EASYRSA_EXTRA_EXTS" ]; then
+		# Check for insert-marker in ssl config file
+		if ! grep -q '^#%EXTRA_EXTS%' "$EASYRSA_SSL_CONF"
+		then
+			die "\
+This openssl config file does \
+does not support EASYRSA_EXTRA_EXTS.
+* $EASYRSA_SSL_CONF
+
+Please update 'openssl-easyrsa.cnf' \
+to the latest Easy-RSA release."
+		fi
+
+		# Setup & insert the extra ext data keyed by magic line
+		extra_exts="
 req_extensions = req_extra
 [ req_extra ]
 $EASYRSA_EXTRA_EXTS"
-		local awkscript='
+		# shellcheck disable=SC2016 # No expand '' - gen_req()
+		awkscript='
 {if ( match($0, "^#%EXTRA_EXTS%") )
 	{ while ( getline<"/dev/stdin" ) {print} next }
  {print}
 }'
+		# Assign temp-file for config
+		adjusted_ssl_cnf_tmp=""
+		easyrsa_mktemp adjusted_ssl_cnf_tmp
+
+		# Insert $extra_exts @ %EXTRA_EXTS% in SSL Config
 		print "$extra_exts" | \
 			awk "$awkscript" "$EASYRSA_SSL_CONF" \
-			> "$EASYRSA_TEMP_FILE" \
-			|| die "Copying SSL config to temp file failed"
-		# Use this new SSL config for the rest of this function
-		local EASYRSA_SSL_CONF="$EASYRSA_TEMP_FILE"
-	fi
-
-	key_out_tmp="$(mktemp -u "$key_out.XXXXXXXXXX")"; EASYRSA_TEMP_FILE_2="$key_out_tmp"
-	req_out_tmp="$(mktemp -u "$req_out.XXXXXXXXXX")"; EASYRSA_TEMP_FILE_3="$req_out_tmp"
-	# generate request
-	[ $EASYRSA_BATCH ] && opts="$opts -batch"
-	"$EASYRSA_OPENSSL" req -utf8 -new -newkey $EASYRSA_ALGO:"$EASYRSA_ALGO_PARAMS" \
-		-config "$EASYRSA_SSL_CONF" -keyout "$key_out_tmp" -out "$req_out_tmp" $opts \
-		|| die "Failed to generate request"
-	mv "$key_out_tmp" "$key_out"; EASYRSA_TEMP_FILE_2=
-	mv "$req_out_tmp" "$req_out"; EASYRSA_TEMP_FILE_3=
+			> "$adjusted_ssl_cnf_tmp" || \
+				die "Writing SSL config to temp file failed"
+
+		[ "${EASYRSA_SAN_CRIT}" ] && \
+			verbose "gen-req: SAN critical OK"
+
+		# Use this SSL config for the rest of this function
+		export EASYRSA_SSL_CONF="$adjusted_ssl_cnf_tmp"
+	fi
+
+	# Name temp files
+	key_out_tmp=""
+	easyrsa_mktemp key_out_tmp
+	req_out_tmp=""
+	easyrsa_mktemp req_out_tmp
+
+	# Set algorithm options
+	algo_opts=""
+	case "$EASYRSA_ALGO" in
+		rsa)
+			# RSA bit-length
+			algo_opts="$EASYRSA_ALGO:$EASYRSA_ALGO_PARAMS"
+			;;
+		ec)
+			# Elliptic curve parameters-file
+			# OpenSSL for Windows cannot load bash style file name
+			# as the -newkey "$newkey_params"
+			# eg:      -newkey ec:/c/Users/me/foo.txt
+			# becomes: -newkey ec:/Users/me/foo.txt
+			if [ "$OS" = Windows_NT ]; then
+				EASYRSA_ALGO_PARAMS="${EASYRSA_ALGO_PARAMS#/?}"
+				verbose "EASYRSA_ALGO_PARAMS: $EASYRSA_ALGO_PARAMS"
+			fi
+
+			algo_opts="$EASYRSA_ALGO:$EASYRSA_ALGO_PARAMS"
+			;;
+		ed)
+			# Edwards curve name
+			algo_opts="$EASYRSA_CURVE"
+			;;
+		*)
+			die "gen_req - Unknown algorithm: $EASYRSA_ALGO"
+	esac
+
+	# Generate request
+	if easyrsa_openssl req -utf8 -new -newkey "$algo_opts" \
+		-keyout "$key_out_tmp" \
+		-out "$req_out_tmp" \
+		${ssl_batch:+ -batch} \
+		${EASYRSA_TEXT_ON:+ -text} \
+		${text:+ -text} \
+		${EASYRSA_NO_PASS:+ "$no_password"} \
+		${EASYRSA_PASSOUT:+ -passout "$EASYRSA_PASSOUT"}
+	then
+		: # ok
+	else
+		die "Failed to generate request"
+	fi
+
+	# Move temp-files to target-files
+	mv "$key_out_tmp" "$key_out" || mv_temp_error=1
+	mv "$req_out_tmp" "$req_out" || mv_temp_error=1
+	if [ "$mv_temp_error" ]; then
+		rm -f "$key_out" "$req_out"
+		die "Failed to move temp key/req file."
+	fi
+
+	# Success messages
 	notice "\
-Keypair and certificate request completed. Your files are:
-req: $req_out
-key: $key_out
-"
-	return 0
+Private-Key and Public-Certificate-Request files created.
+Your files are:
+* req: $req_out
+* key: $key_out${do_build_full:+ $NL}"
 } # => gen_req()
 
 # common signing backend
 sign_req() {
-	local crt_type="$1" opts=
-	local req_in="$EASYRSA_PKI/reqs/$2.req"
-	local crt_out="$EASYRSA_PKI/issued/$2.crt"
-
-	# Support batch by internal caller:
-	[ "$3" = "batch" ] && local EASYRSA_BATCH=1
+	crt_type="$1"
+	file_name_base="$2"
+
+	# Verify $crt_type is valid
+	case "$crt_type" in
+		ca)
+			# Inline file not required for signing a sub CA
+			EASYRSA_NO_INLINE=1
+		;;
+		server|serverClient|client|codeSigning|email)
+			: # All known types
+		;;
+		*)
+			warn "\
+Unrecognised x509-type: '$crt_type'
 
-	verify_ca_init
+In order to sign a custom X509 Type certificate, there must be a
+corresponding SSL configuration file in the 'x509-types' folder."
+	esac
 
 	# Check argument sanity:
-	[ -n "$2" ] || die "\
+	[ "$file_name_base" ] || user_error "\
 Incorrect number of arguments provided to sign-req:
 expected 2, got $# (see command help for usage)"
 
-	# Cert type must exist under the EASYRSA_EXT_DIR
-	[ -r "$EASYRSA_EXT_DIR/$crt_type" ] || die "\
-Unknown cert type '$crt_type'"
+	req_in="$EASYRSA_PKI/reqs/$file_name_base.req"
+	crt_out="$EASYRSA_PKI/issued/$file_name_base.crt"
+	shift 2
 
-	# Request file must exist
-	[ -f "$req_in" ] || die "\
-No request found for the input: '$2'
-Expected to find the request at: $req_in"
+	# Check optional subject
+	force_subj=
+	while [ "$1" ]; do
+		case "$1" in
+			nopass)
+				warn "Ignoring option '$1'"
+				;;
+			newsubj*)
+				# verify force_subj opts are used correctly
+				[ "$EASYRSA_NEW_SUBJECT" ] || user_error "\
+To force a new certificate subject, global option --new-subject
+must also be specified."
+				force_subj="$EASYRSA_NEW_SUBJECT"
+				;;
+			preserve*)
+				export EASYRSA_PRESERVE_DN=1
+				;;
+			*)
+				user_error "Unknown option '$1'"
+		esac
+		shift
+	done
 
-	# Confirm input is a cert req
-	verify_file req "$req_in" || die "\
-The certificate request file is not in a valid X509 request format.
-Offending file: $req_in"
+	# verify force_subj opts are used correctly
+	if [ "$EASYRSA_NEW_SUBJECT" ]; then
+		[ "$force_subj" ] || user_error "\
+To force a new certificate subject, command option 'newsubj'
+must also be specified."
+	fi
 
-	# Display the request subject in an easy-to-read format
-	# Confirm the user wishes to sign this request
-	confirm "Confirm request details: " "yes" "
-You are about to sign the following certificate.
-Please check over the details shown below for accuracy. Note that this request
-has not been cryptographically verified. Please be sure it came from a trusted
-source or that you have verified the request checksum with the sender.
+	# Cert type must NOT be COMMON
+	[ "$crt_type" = COMMON ] && user_error "\
+Invalid certificate type: '$crt_type'"
+
+	# Request file must exist
+	[ -f "$req_in" ] || user_error "\
+No request found for the input: '$file_name_base'
+Expected to find the request at:
+* $req_in"
+
+	# Certificate file must NOT exist
+	[ -f "$crt_out" ] && user_error "\
+Cannot sign this request for '$file_name_base'.
+Conflicting certificate exists at:
+* $crt_out"
+
+	# Confirm input is a cert req
+	verify_file req "$req_in" || user_error "\
+The certificate request file is not in a valid X509 format:
+* $req_in"
+
+	# Randomize Serial number
+	if [ "$EASYRSA_RAND_SN" != no ]; then
+		serial=""
+		serial_is_unique=""
+		check_serial="" # set by check_serial_unique(), used for err-msg
+
+		for i in 1 2 3 4 5; do
+			easyrsa_random 16 serial
+
+			# Require 128bit serial number
+			[ "$serial" = "${serial#00}" ] || continue
+
+			# Check for duplicate serial in CA db
+			if check_serial_unique "$serial" batch; then
+				serial_is_unique=1
+				break
+			fi
+		done
+
+		# Check for unique_serial
+		[ "$serial_is_unique" ] || die "\
+sign_req - Randomize Serial number failed:
+
+$check_serial"
+
+		# Print random $serial to pki/serial file
+		# for use by SSL config
+		print "$serial" > "$EASYRSA_PKI/serial" || \
+			die "sign_req - write serial to file"
+		unset -v serial check_serial serial_is_unique
+	fi
+
+	# When EASYRSA_CP_EXT is defined,
+	# adjust openssl's [default_ca] section:
+	if [ "$EASYRSA_CP_EXT" ]; then
+		# Check for insert-marker in ssl config file
+		if ! grep -q '^#%COPY_EXTS%' "$EASYRSA_SSL_CONF"
+		then
+			die "\
+This openssl config file does \
+not support option '--copy-ext'.
+* $EASYRSA_SSL_CONF
+
+Please update 'openssl-easyrsa.cnf' \
+to the latest Easy-RSA release."
+		fi
+
+		# Setup & insert the copy_extensions data
+		# keyed by a magic line
+		copy_exts="copy_extensions = copy"
+		# shellcheck disable=SC2016 # No expand '' - sign_req()
+		awkscript='
+{if ( match($0, "^#%COPY_EXTS%") )
+	{ while ( getline<"/dev/stdin" ) {print} next }
+ {print}
+}'
+		# Assign temp-file for config
+		adjusted_ssl_cnf_tmp=""
+		easyrsa_mktemp adjusted_ssl_cnf_tmp
+
+		print "$copy_exts" | \
+			awk "$awkscript" "$EASYRSA_SSL_CONF" \
+				> "$adjusted_ssl_cnf_tmp" || die "\
+Writing 'copy_exts' to SSL config temp-file failed"
+
+		# Use this SSL config for the rest of this function
+		export EASYRSA_SSL_CONF="$adjusted_ssl_cnf_tmp"
+		verbose "Using '$copy_exts'"
+		verbose "EASYRSA_SSL_CONF = $EASYRSA_SSL_CONF"
+	fi
+
+	# Find or create x509-type file
+	# Note: $new_x509_type_file_tmp is non-local
+	# set by select_x509_type_tmp()
+	select_x509_type_tmp "$crt_type"
+	x509_type_tmp_file_USER="$new_x509_type_file_tmp"
+	verbose "x509_type_tmp_file_USER = '$x509_type_tmp_file_USER'"
+
+	# keyUsage critical
+	confirm_ku_crit=
+	if [ "$EASYRSA_KU_CRIT" ]; then
+		add_critical_attrib keyUsage \
+			"$x509_type_tmp_file_USER" x509_type_tmp_file_USER || \
+				die "sign-req - add_critical_attrib kU"
+		confirm_ku_crit="  keyUsage:         'critical'${NL}"
+		verbose "keyUsage critical OK"
+	fi
+
+	# basicConstraints critical
+	confirm_bc_crit=
+	if [ "$EASYRSA_BC_CRIT" ]; then
+		add_critical_attrib basicConstraints \
+			"$x509_type_tmp_file_USER" x509_type_tmp_file_USER || \
+				die "sign-req - add_critical_attrib bC"
+		confirm_bc_crit="  basicConstraints: 'critical'${NL}"
+		verbose "basicConstraints critical OK"
+	fi
+
+	# extendedKeyUsage critical
+	confirm_eku_crit=
+	if [ "$EASYRSA_EKU_CRIT" ]; then
+		add_critical_attrib extendedKeyUsage \
+			"$x509_type_tmp_file_USER" x509_type_tmp_file_USER || \
+				die "sign-req - add_critical_attrib eKU"
+		confirm_eku_crit="  extendedKeyUsage: 'critical'${NL}"
+		verbose "extendedKeyUsage critical OK"
+	fi
+
+	# Find or create x509 COMMON file
+	select_x509_type_tmp COMMON
+	x509_type_tmp_file_COMMON="$new_x509_type_file_tmp"
+	verbose "x509_type_tmp_file_COMMON = '$x509_type_tmp_file_COMMON'"
+
+	# Support a dynamic CA path length when present:
+	unset -v basicConstraints confirm_bc_len
+	if [ "$crt_type" = "ca" ] && [ "$EASYRSA_SUBCA_LEN" ]
+	then
+		# Print the last occurrence of basicConstraints in
+		# x509-types/ca
+		# If basicConstraints is not defined then bail
+		# shellcheck disable=SC2016 # No expand '' - sign_req()
+		awkscript='\
+/^[[:blank:]]*basicConstraints[[:blank:]]*=/ { bC=$0 }
+END { if (length(bC) == 0 ) exit 1; print bC }'
+		basicConstraints="$(
+			awk "$awkscript" "$x509_type_tmp_file_USER"
+			)" || die "\
+basicConstraints is not defined, cannot use 'pathlen'"
+		confirm_pathlen="
+  Path length:      '$EASYRSA_SUBCA_LEN'${NL}"
+		verbose "Using basicConstraints pathlen"
+	fi
+
+	# Deprecated Netscape extension support
+	case "$EASYRSA_NS_SUPPORT" in
+	[yY][eE][sS])
+
+		confirm "Confirm use of Netscape extensions: " yes \
+			"WARNING: Netscape extensions are DEPRECATED!"
+
+		# Netscape extension
+		case "$crt_type" in
+			serverClient)
+				ns_cert_type="nsCertType = serverClient" ;;
+			server)
+				ns_cert_type="nsCertType = server" ;;
+			client)
+				ns_cert_type="nsCertType = client" ;;
+			ca)
+				ns_cert_type="nsCertType = sslCA" ;;
+			*)
+				ns_cert_type="nsCertType = $crt_type"
+		esac
+		verbose "Using $ns_cert_type"
+		;;
+	*)
+		# ok No NS support required
+		unset -v ns_cert_type
+	esac
+
+	# Get request CN
+	# EASYRSA_REQ_CN MUST always be set to the CSR CN
+	# or use --new-subect
+	EASYRSA_REQ_CN="$(
+		"$EASYRSA_OPENSSL" req -utf8 -in "$req_in" -noout \
+			-subject -nameopt multiline | grep 'commonName'
+	)" || warn "sign-req - EASYRSA_REQ_CN FAILED"
+	EASYRSA_REQ_CN="${EASYRSA_REQ_CN##*= }"
+
+	# Add auto SAN, if EASYRSA_AUTO_SAN is enabled
+	if [ -z "$EASYRSA_SAN" ] && [ "$EASYRSA_AUTO_SAN" ]; then
+		# Choose DNS:san or IP:san
+		if print "$EASYRSA_REQ_CN" | grep -q \
+			'^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$'
+		then
+			EASYRSA_SAN="IP:${EASYRSA_REQ_CN}"
+		else
+			EASYRSA_SAN="DNS:${EASYRSA_REQ_CN}"
+		fi
 
-Request subject, to be signed as a $crt_type certificate for $EASYRSA_CERT_EXPIRE days:
+		# Add auto SAN to EASYRSA_EXTRA_EXTS
+		EASYRSA_EXTRA_EXTS="\
+$EASYRSA_EXTRA_EXTS
+subjectAltName = ${EASYRSA_SAN_CRIT}${EASYRSA_SAN}"
+		verbose "Auto SAN: ${EASYRSA_SAN}"
+	fi
 
-$(display_dn req "$req_in")
-"	# => confirm end
+	# confirm SAN critical
+	confirm_san_crit=
+	if [ "${EASYRSA_SAN_CRIT}" ]; then
+		confirm_san_crit="  subjectAltName:   'critical'${NL}"
+		verbose "SAN critical OK"
+	fi
 
 	# Generate the extensions file for this cert:
+	ext_tmp=""
+	easyrsa_mktemp ext_tmp
+
+	# Begin output redirect
 	{
-		# Append first any COMMON file (if present) then the cert-type extensions
-		cat "$EASYRSA_EXT_DIR/COMMON"
-		cat "$EASYRSA_EXT_DIR/$crt_type"
+		# Append $cert-type extensions
+		cat "$x509_type_tmp_file_USER" "$x509_type_tmp_file_COMMON"
 
 		# Support a dynamic CA path length when present:
-		[ "$crt_type" = "ca" ] && [ -n "$EASYRSA_SUBCA_LEN" ] && \
-			print "basicConstraints = CA:TRUE, pathlen:$EASYRSA_SUBCA_LEN"
-
-		# Deprecated Netscape extension support, if enabled
-		if print "$EASYRSA_NS_SUPPORT" | awk_yesno; then
-			[ -n "$EASYRSA_NS_COMMENT" ] && \
-				print "nsComment = \"$EASYRSA_NS_COMMENT\""
-			case "$crt_type" in
-				server)	print "nsCertType = server" ;;
-				client)	print "nsCertType = client" ;;
-				ca)	print "nsCertType = sslCA" ;;
-			esac
+		if [ "$basicConstraints" ]; then
+			print "$basicConstraints, pathlen:$EASYRSA_SUBCA_LEN"
+		fi
+
+		# Deprecated Netscape extension support
+		if [ "$ns_cert_type" ]; then
+			print "$ns_cert_type"
+			print "nsComment = \"$EASYRSA_NS_COMMENT\""
 		fi
 
-		# Add any advanced extensions supplied by env-var:
-		[ -n "$EASYRSA_EXTRA_EXTS" ] && print "$EASYRSA_EXTRA_EXTS"
-		
-		: # needed to keep die from inherting the above test
-	} > "$EASYRSA_TEMP_FILE" || die "\
+		# Add user supplied extra extensions
+		# and/or SAN extension
+		if [ "$EASYRSA_EXTRA_EXTS" ]; then
+			print "$EASYRSA_EXTRA_EXTS"
+		fi
+	} > "$ext_tmp" || die "\
 Failed to create temp extension file (bad permissions?) at:
-$EASYRSA_TEMP_FILE"
+* $ext_tmp"
+	verbose "Generated extensions file OK: '$ext_tmp'"
+
+	# Set confirm CN
+	confirm_CN="  Requested CN:     '$EASYRSA_REQ_CN'"
+
+	# Set confirm type
+	confirm_type="  Requested type:   '$crt_type'"
+
+	# Set confirm valid_period message
+	if [ "$EASYRSA_END_DATE" ]; then
+		confirm_period="  Valid until:      '$EASYRSA_END_DATE'"
+	else
+		confirm_period="  Valid for:        '$EASYRSA_CERT_EXPIRE' days"
+	fi
+
+	# Set confirm DN
+	if [ "$force_subj" ]; then
+		confirm_dn="${NL}* Forced Subject:   '$force_subj'${NL}"
+	else
+		confirm_dn="${NL}$(display_dn req "$req_in")" || \
+			die "sign-req: display_dn"
+	fi
+
+	# Set confirm SAN
+	# SAN from .req
+	if [ "$EASYRSA_CP_EXT" ]; then
+		# capture complete CSR
+		req_text="$(
+			"$EASYRSA_OPENSSL" req -utf8 -in "$req_in" -noout -text
+			)" || die "sign-req: openssl: req_text"
+
+		# Check CSR for any requested SAN
+		if echo "$req_text" | \
+			grep -q 'X509v3 Subject Alternative Name'
+		then
+			# extract requested SAN
+			# 'grep -A' may not be strictly POSIX, die on error
+			req_x509_san="$(
+				echo "$req_text" | \
+					grep -A 1 'X509v3 Subject Alternative Name'
+			)" || die "sign-req: req_x509_san: grep -A 1 (POSIX)"
+		else
+			# No requested SAN
+			req_x509_san=
+		fi
+	fi
+
+	# Set confirm details
+	confirm_critical_attribs="
+${confirm_bc_crit}${confirm_ku_crit}\
+${confirm_eku_crit}${confirm_san_crit}"
+
+	confirm_details="\
+${confirm_CN}
+${confirm_type}${confirm_pathlen}
+${confirm_period}
+${confirm_critical_attribs}${confirm_dn}"
+
+	# --san takes priority over req SAN and --copy-ext
+	if [ "$EASYRSA_SAN" ]; then
+		confirm_san="\
+            X509v3 Subject Alternative Name:
+                ${EASYRSA_SAN_CRIT}${EASYRSA_SAN}"
+	else
+		confirm_san="$req_x509_san"
+	fi
+
+	# Set confirm SAN
+	if [ "$EASYRSA_SAN" ] || [ "$req_x509_san" ]; then
+		confirm_details="$confirm_details${NL}${NL}$confirm_san"
+	fi
+
+	# Display the request subject in an easy-to-read format
+	# Confirm the user wishes to sign this request
+	# The foreign_request confirmation is not required
+	# for build_full:
+	if [ "$local_request" ]; then
+		unset -v foreign_request
+	else
+		foreign_request="\
+Please check over the details shown below for accuracy. \
+Note that this request
+has not been cryptographically verified. Please be sure \
+it came from a trusted
+source or that you have verified the request checksum \
+with the sender.$NL"
+	fi
+
+	# Request FINAL user confirmation
+	confirm "Confirm requested details: " "yes" "\
+${foreign_request}You are about to sign the following certificate:
+
+$confirm_details" # => confirm end
+
+	# Assign temp cert file
+	crt_out_tmp=""
+	easyrsa_mktemp crt_out_tmp
 
 	# sign request
-	crt_out_tmp="$(mktemp -u "$crt_out.XXXXXXXXXX")"; EASYRSA_TEMP_FILE_2="$crt_out_tmp"
-	"$EASYRSA_OPENSSL" ca -utf8 -in "$req_in" -out "$crt_out_tmp" -config "$EASYRSA_SSL_CONF" \
-		-extfile "$EASYRSA_TEMP_FILE" -days $EASYRSA_CERT_EXPIRE -batch $opts \
-		|| die "signing failed (openssl output above may have more detail)"
-	mv "$crt_out_tmp" "$crt_out"; EASYRSA_TEMP_FILE_2=
+	easyrsa_openssl ca -utf8 -batch \
+		-in "$req_in" -out "$crt_out_tmp" \
+		-extfile "$ext_tmp" \
+		${EASYRSA_PRESERVE_DN:+ -preserveDN} \
+		${force_subj:+ -subj "$force_subj"} \
+		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+		${EASYRSA_TEXT_OFF:+ -notext} \
+		${EASYRSA_CERT_EXPIRE:+ -days "$EASYRSA_CERT_EXPIRE"} \
+		${EASYRSA_START_DATE:+ -startdate "$EASYRSA_START_DATE"} \
+		${EASYRSA_END_DATE:+ -enddate "$EASYRSA_END_DATE"} \
+			|| die "\
+Signing failed (openssl output above may have more detail)"
+	verbose "signed cert OK: '$file_name_base'"
+
+	# Move temp-files to target-files
+	mv "$crt_out_tmp" "$crt_out" || mv_temp_error=1
+	if [ "$mv_temp_error" ]; then
+		rm -f "$crt_out"
+		die "Failed to move temp certificate file."
+	fi
+
+	# inline file
+	inline_file std "$file_name_base"
+
+	# Success messages
 	notice "\
-Certificate created at: $crt_out
-"
-	return 0
+Certificate created at:
+* $crt_out"
 } # => sign_req()
 
+# Add 'critical' attribute to X509-type file
+add_critical_attrib() {
+	case "$1" in
+		basicConstraints|keyUsage|extendedKeyUsage) : ;; # ok
+		*) die "add_critical_attrib - usage: '$1'"
+	esac
+
+	[ -f "$2" ] || die "add_critical_attrib - missing input file"
+	[ "$3" ] || die "add_critical_attrib - missing variable"
+
+	crit_tmp=
+	easyrsa_mktemp crit_tmp
+
+	# Insert 'critical,' attrib, ONLY if NOT present
+	srch="${1}[[:blank:]]*=[[:blank:]]*critical"
+	repl="${1}[[:blank:]]*=[[:blank:]]*"
+	with="${1} = critical,"
+	sed /"$srch"/!s/"$repl"/"$with"/g \
+		"$2" > "$crit_tmp" || return 1
+
+	# Use the new tmp-file:$crit_tmp with critical attribute
+	force_set_var "$3" "$crit_tmp" || return 1
+
+	verbose "add_critical_attrib; ${1}: force_set_var: ${3} = ${crit_tmp}"
+	unset -v srch repl with crit_tmp
+} # => add_critical_attrib()
+
+# Check serial in db
+check_serial_unique() {
+	[ "$1" ] || user_error "Serial number required!"
+	case "$1" in
+		(*[!1234567890abcdef]*)
+			user_error "Invalid serial number: '$1'"
+	esac
+
+	# Check for openssl -status of serial number
+	# Always errors out - Do not capture error
+	check_serial="$(
+			export OPENSSL_CONF="$EASYRSA_SSL_CONF"
+			"$EASYRSA_OPENSSL" ca -status "$1" 2>&1
+		)" || :
+
+	# Check for duplicate serial in CA db
+	unique_serial_true=
+	case "$check_serial" in
+		(*"not present in db"*)
+			unique_serial_true=1
+			verbose "check_serial_unique; unique_serial=true"
+			;;
+		# This is caused by file:index.txt.attr being set to
+		# 'unique_subject = yes' AND a duplicate cert subject
+		(*"Error creating name index"*)
+			die "check_serial_unique(): Duplicate Subject conflict"
+			;;
+		*)
+			verbose "check_serial_unique; unique_serial=false"
+	esac
+
+	# In batch mode return result only
+	if [ "$2" = batch ] || [ "$EASYRSA_BATCH" ]; then
+		if [ "$unique_serial_true" ]; then
+			return 0
+		else
+			return 1
+		fi
+	fi
+
+	# Otherwise, show result to user
+	# and do not return any error code
+	print "
+check_serial_status RESULT:
+========================================
+
+$check_serial
+
+========================================
+COMPLETE"
+} # => check_serial_unique()
+
 # common build backend
 # used to generate+sign in 1 step
 build_full() {
-	verify_ca_init
+	# pull filename base:
+	[ "$2" ] || user_error "\
+Error: didn't find a file base name as the first argument.
+Run easyrsa without commands for usage and commands."
+
+	crt_type="$1"
+	name="$2"
+	shift 2
+
+	req_out="$EASYRSA_PKI/reqs/$name.req"
+	key_out="$EASYRSA_PKI/private/$name.key"
+	crt_out="$EASYRSA_PKI/issued/$name.crt"
+
+	# function opts support
+	while [ "$1" ]; do
+		case "$1" in
+			nopass)
+				[ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1
+				;;
+			*) user_error "Unknown command option: '$1'"
+		esac
+		shift
+	done
+
+	# abort on existing req/key/crt files
+	err_exists="\
+file already exists. Aborting build to avoid overwriting this file.
+If you wish to continue, please use a different name.
+Conflicting file found at:
+*"
+	[ -f "$req_out" ] && \
+		user_error "Request $err_exists $req_out"
+	[ -f "$key_out" ] && \
+		user_error "Key $err_exists $key_out"
+	[ -f "$crt_out" ] && \
+		user_error "Certificate $err_exists $crt_out"
+	unset -v err_exists
+
+	# create request
+	verbose "build_full: BEGIN gen_req"
+	fn_name="$fn_name; gen_req"
+	gen_req "$name" batch
+	fn_name="${fn_name%; gen_req}"
+	verbose "build_full: END gen_req"
+
+	# Set to modify sign-req confirmation message
+	local_request=1
+
+	# Recreate temp-session and
+	# drop edits to SSL Conf file
+	remove_secure_session
+	secure_session
+	locate_support_files
+	select_ssl_cnf_tmp
+	write_global_safe_ssl_cnf_tmp
+
+	# Require --copy-ext
+	export EASYRSA_CP_EXT=1
+
+	# Sign it
+	verbose "build_full: BEGIN sign_req"
+	fn_name="$fn_name; sign_req"
+	error_build_full_cleanup=1
+	if sign_req "$crt_type" "$name"; then
+		unset -v error_build_full_cleanup do_build_full
+	else
+		die "\
+Failed to sign '$name' - \
+See error messages above for details."
+	fi
+	fn_name="${fn_name%; sign_req}"
+	verbose "build_full: END sign_req"
+} # => build_full()
+
+# Generate inline file V2
+inline_file() {
+	# Allow complete disable
+	if [ "$EASYRSA_NO_INLINE" ] || [ "$EASYRSA_DISABLE_INLINE" ]; then
+		[ -z "$EASYRSA_DISABLE_INLINE" ] || \
+			warn "Use \$EASYRSA_NO_INLINE not \$EASYRSA_DISABLE_INLINE"
+		verbose "inline_file; DISABLED"
+		return
+	fi
+
+	# Set inline type
+	case "$1" in
+		std|p12|pfp) inline_type="$1" ;;
+		*) die "unknown inline type"
+	esac
+	shift # scrape off inline_type
+
+	# Source files
+	crt_source="${EASYRSA_PKI}/issued/${1}.crt"
+	key_source="${EASYRSA_PKI}/private/${1}.key"
+	ca_source="$EASYRSA_PKI"/ca.crt
+	tls_source="$EASYRSA_PKI"/private/easyrsa-tls.key
+	old_tls_key_file="$EASYRSA_PKI"/easyrsa-keepsafe-tls.key
+	dh_params_source="$EASYRSA_PKI"/dh.pem
+	external_ca_list="$EASYRSA_PKI"/inline/external-ca.list
+
+	# make inline dir
+	mkdir -p "$EASYRSA_PKI"/inline/private || \
+		die "inline_file() - failed to create 'inline' directory."
+
+	readme="$EASYRSA_PKI"/inline/private/README.inline.private
+	if [ ! -f "$readme" ]; then
+		print "\
+# Inline files in the 'private' directory contain security keys
+# which MUST ONLY be transmitted over a SECURE connection.
+# eg. 'https' or 'scp'." > "$readme" || \
+			warn "inline_file - Failed to create README"
+	fi
+	unset -v readme
+
+	# Use inline type p12
+	case "$inline_type" in
+	p12)
+		inline_out="${EASYRSA_PKI}/inline/private/${1}.p12-inline"
+
+		# Get cert CN
+		inline_CN="$(
+			"$EASYRSA_OPENSSL" x509 -in "$crt_source" -noout -subject \
+				-nameopt multiline,-esc_msb | grep 'commonName'
+		)" || return 1
+		inline_CN="${inline_CN##*= }"
+
+		# BASE64 encode pkcs12 source file
+		inline_tmp=
+		easyrsa_mktemp inline_tmp
+		"$EASYRSA_OPENSSL" enc -a -in "$2" > "$inline_tmp" || return 1
+
+		# make inline file
+		print "\
+# Easy-RSA Inline file
+# Inline type: BASE64 pkcs12
+# commonName: ${inline_CN}
+
+<pkcs12>
+$(cat "$inline_tmp")
+</pkcs12>" > "$inline_out" || return 1
+
+		# p12 inline file completed
+		return
+	esac
+
+	# flags
+	inline_incomplete=
+	inline_private=
+
+	# output
+	inline_out="${EASYRSA_PKI}/inline/${1}.inline"
+
+	# Generate Inline data
+	# Certificate
+	if [ -f "$crt_source" ]; then
+		crt_data="\
+<cert>
+$(cat "$crt_source")
+</cert>"
+
+		# Calculate decimal value for serial number
+		# because openvpn uses decimal serial
+		# for '--crl-verify /path/to/dir dir'
+		if which bc 1>/dev/null 2>&1; then
+			inline_crt_serial=
+			ssl_cert_serial "$crt_source" inline_crt_serial || \
+				die "inline_file - ssl_cert_serial"
+			crt_serial_dec="$(
+					echo "ibase=16; $inline_crt_serial" | bc
+				)" || die "inline_file - HEX to DEC failed"
+		else
+			crt_serial_dec="Unavailable"
+		fi
+
+		# Generate fingerprint
+		crt_fingerprint="$(
+			"$EASYRSA_OPENSSL" x509 -in "$crt_source" \
+				-noout -sha256 -fingerprint
+			)" || die "inline_file - Failed -fingerprint"
+		# strip prefix
+		crt_fingerprint="${crt_fingerprint#*=}"
+
+		# Certificate type
+		inline_crt_type=
+		ssl_cert_x509v3_eku "$crt_source" inline_crt_type || \
+			warn "inline_file: Unknown cert-type: '$inline_crt_type'"
+
+		# commonName
+		inline_crt_CN="$(
+			display_dn x509 "$crt_source" | grep 'commonName'
+		)" || die "inline_file: Failed to set inline_crt_CN"
+		# strip prefix
+		inline_crt_CN="${inline_crt_CN#*= }"
+	else
+		inline_incomplete="Missing certificate"
+		crt_data="\
+# When you recieve your signed certificate place it in the
+# 'pki/issued' sub-dir of your PKI and use command 'inline'
+# to rebuild this inline file with your certificate.
+# <cert>
+# * Paste your user certificate here *
+# </cert>"
+
+		crt_fingerprint=unknown
+		inline_crt_type=unknown
+		inline_crt_CN=unknown
+	fi
+
+	# Private key
+	if [ -f "$key_source" ]; then
+		inline_private=1
+		key_data="\
+<key>
+$(cat "$key_source")
+</key>"
+	else
+		inline_incomplete="Missing private key"
+		key_data="\
+# When you recieve your key place it in the
+# 'pki/private' sub-dir of your PKI and use command 'inline'
+# to rebuild this inline file with your key.
+# <key>
+# * Paste your private key here *
+# </key>"
+	fi
+
+	# CA certificate
+	ca_data=
+	ext_ca_data=
+	case "$inline_crt_type" in
+		# OpenVPN 2.5 or older does not support --peer-fingerprint
+		# Easy-RSA does not support old OpenVPN because it is not
+		# possible to determine which self-siged-server cert to use.
+		self-signed-client)
+			ca_data="\
+# Since OpenVPN 2.6 --peer-fingerprint --client does not require a CA
+# OpenVPN 2.5 or older requires the self-siged-server certificate
+# placed here."
+		;;
+		self-signed-server)
+			ca_data="\
+# CA ceriticate not required for --peer-fingerprint server"
+		;;
+		*)
+			if [ -f "$ca_source" ]; then
+				# External CA
+				if [ -f "$external_ca_list" ]; then
+					ext_ca_data="${NL}$(cat "$external_ca_list")"
+				fi
+
+				# Standard CA
+				ca_data="\
+<ca>
+$(cat "$ca_source")${ext_ca_data}
+</ca>"
+			else
+				inline_incomplete="Missing CA"
+				ca_data="\
+# When you recieve your CA certificate place it in the
+# 'pki' sub-dir of your PKI and use command 'inline'
+# to rebuild this inline file with your CA certificate.
+# <ca>
+# * Paste your CA certificate here *
+# </ca>"
+			fi
+	esac
+
+	# Diffie-Hellman parameters file
+	dh_params_data=
+	case "$inline_crt_type" in
+	server|serverClient)
+		# Collect DH data
+		if [ "$EASYRSA_ALGO" = rsa ]; then
+			if [ -f "$dh_params_source" ]; then
+				dh_params_data="${NL}
+<dh>
+$(cat "$dh_params_source")
+</dh>"
+			else
+				inline_incomplete="Missing dh-params"
+				dh_params_data="${NL}
+# <dh>
+# * Paste your Diffie-Hellman parameters file here *
+# </dh>"
+			fi
+		else
+			# ok, not RSA
+			dh_params_data="${NL}
+# Diffie-Hellman parameters file not required
+dh none"
+		fi
+		;;
+		self-signed-server)
+			# ok, self-sign
+			dh_params_data="${NL}
+# Diffie-Hellman parameters file not required
+dh none"
+		;;
+		*) : # ok, not server
+	esac
+	# Append DH data to CA data
+	ca_data="${ca_data}${dh_params_data}"
+
+	# TLS KEY - Set TLS auth|crypt key inline label
+	tls_key_data=
+	if [ -f "$tls_source" ]; then
+		tls_key_data="$(cat "$tls_source")"
+		case "$tls_key_data" in
+			*'TLS-AUTH'*) tls_key_label=tls-auth ;;
+			*'TLS-CRYPT'*) tls_key_label=tls-crypt ;;
+			*) tls_key_label=
+		esac
+	fi
+
+	# Do NOT add TLS key if OLD TLS key exists
+	# because this PSK has already been shared.
+	if [ -f "$old_tls_key_file" ]; then
+		tls_data="\
+# Add the existing TLS AUTH/CRYPT-V1 Key here:
+# <${tls_key_label}>
+# * Paste The existing pre-shared TLS key here *
+# </${tls_key_label}>"
+
+		# Add --key-direction for TLS-AUTH
+		[ "$tls_key_label" = tls-auth ] && \
+			tls_data="$tls_data
+#
+# Add the required 'key-direction 0|1' here:
+# key-direction 1"
+		unset -v tls_key_data tls_key_label
+	else
+		# Add standard TLS key details
+		if [ -f "$tls_source" ]; then
+			inline_private=1
+			if [ "$tls_key_label" ]; then
+				tls_data="\
+<${tls_key_label}>
+${tls_key_data}
+</${tls_key_label}>"
+			else
+				inline_incomplete="Unknown TLS Key"
+				tls_data="# Easy-RSA TLS Key not recognised!"
+			fi
+		else
+			inline_incomplete="Missing TLS Key, see 'easyrsa help gen-tls'"
+			tls_data="# Easy-RSA TLS Key not found!"
+		fi
+	fi
+
+	# Only support inline TLS keys for OpenVPN server/client use
+	case "$inline_crt_type" in
+		server|self-signed-server)
+			key_direction="key-direction 0" ;;
+		client|self-signed-client)
+			key_direction="key-direction 1" ;;
+		*)
+			tls_key_label=
+			key_direction=
+			tls_data="# No TLS Key support for cert-type: $inline_crt_type"
+			verbose "inline: Unsupported cert-type: $inline_crt_type"
+	esac
+
+	# Add --key-direction for TLS-AUTH
+	if [ "$tls_key_label" = tls-auth ]; then
+		tls_data="${tls_data}${NL}${NL}${key_direction}"
+	fi
+
+	# If inline file has keys then redirect to 'private' dir
+	[ "$inline_private" ] && \
+		inline_out="${EASYRSA_PKI}/inline/private/${1}.inline"
+
+	# Print data
+	print "\
+# Easy-RSA Inline file
+# Certificate type: $inline_crt_type
+# commonName: $inline_crt_CN
+# SHA256 fingerprint:
+# $crt_fingerprint
+# Decimal serial number: $crt_serial_dec
+
+$crt_data
+
+$key_data
+
+$ca_data
+
+$tls_data
+" > "$inline_out"
+
+	# Use inline type pfp
+	case "$inline_type" in
+	pfp)
+		# create/update peer fingerprint list, for $inline_crt_type
+		case "$inline_crt_type" in
+			self-signed-server) list_type=server; used_by_type=client ;;
+			self-signed-client) list_type=client; used_by_type=server ;;
+			*) die "Unsupported pfp cert-type: '$inline_crt_type'"
+		esac
+
+		pfp_error_msg=
+		pfp_list_tmp=
+		easyrsa_mktemp pfp_list_tmp
+
+		# create fingerprint list header
+		pfp_list_file="$EASYRSA_PKI"/inline/pfp-"$list_type".list-inline
+		if [ ! -f "$pfp_list_file" ]; then
+			print "\
+# Easy-RSA Inline file
+# Certificate type: $inline_crt_type
+# This file is for use by your $used_by_type
+<peer-fingerprint>
+</peer-fingerprint>" > "$pfp_list_file" || \
+				pfp_error_msg="header Failed!${NL}"
+		fi
+
+		# set new CN and fingerprint
+		new_pfp="\
+# commonName: $inline_crt_CN
+$crt_fingerprint"
+
+		# delete trailing '</peer-fingerprint' line
+		if [ -z "$pfp_error_msg" ]; then
+			sed -e /'<\/peer-fingerprint>'/d "$pfp_list_file" \
+				>> "$pfp_list_tmp" || \
+					pfp_error_msg="${pfp_error_msg}sed Failed!${NL}"
+		fi
+
+		# add new fingerprint and trailing '</peer-fingerprint' lines
+		if [ -z "$pfp_error_msg" ]; then
+			print "${new_pfp}${NL}</peer-fingerprint>" \
+				>> "$pfp_list_tmp" || \
+					pfp_error_msg="${pfp_error_msg}update Failed!${NL}"
+		fi
+
+		# move tmp-file to list file
+		if [ -z "$pfp_error_msg" ]; then
+			# back up the current pfp list
+			if [ -f "$pfp_list_file" ]; then
+				rm -f "$pfp_list_file".old
+				mv "$pfp_list_file" "$pfp_list_file".old || \
+					pfp_error_msg="${pfp_error_msg}move 1 Failed!${NL}"
+			fi
+
+			mv "$pfp_list_tmp" "$pfp_list_file" || \
+				pfp_error_msg="${pfp_error_msg}move 2 Failed!${NL}"
+		fi
+
+		# user info
+		if [ -z "$pfp_error_msg" ]; then
+			notice "\
+Updated the '$inline_crt_type' peer-fingerprint list at:
+* $pfp_list_file"
+		else
+			warn "inline_file() pfp;${NL}${pfp_error_msg}"
+		fi
+	esac
+
+	# user info
+	if [ "$inline_incomplete" ]; then
+		warn "\
+INCOMPLETE Inline file created:
+* $inline_out
+
+$inline_incomplete"
+	else
+		notice "\
+Inline file created:
+* $inline_out"
+	fi
+	verbose "inline_file; COMPLETED"
+} # => inline_file()
+
+# revoke backend
+revoke() {
+	# Set cert directory (IE. type) to revoke
+	cert_dir="$1"
+	shift
+
+	# pull filename base:
+	[ "$1" ] || user_error "\
+Error: didn't find a file base name as the first argument.
+Run easyrsa without commands for usage and command help."
+
+	# Assign file_name_base and dust off!
+	file_name_base="$1"
+	shift
+
+	in_dir="$EASYRSA_PKI"
+	key_in="$in_dir/private/${file_name_base}.key"
+	req_in="$in_dir/reqs/${file_name_base}.req"
+	inline_pub="$in_dir/inline/${file_name_base}.inline"
+	inline_pri="$in_dir/inline/private/${file_name_base}.inline"
+
+	# input cert for revocation: issued, expired or renewed
+	crt_in="${in_dir}/${cert_dir}/${file_name_base}.crt"
+
+	# Assign possible "crl_reason"
+	if [ "$1" ]; then
+		crl_reason="$1"
+		shift
+
+		case "$crl_reason" in
+			us|uns*) crl_reason=unspecified ;;
+			kc|key*) crl_reason=keyCompromise ;;
+			cc|[Cc][Aa]*) crl_reason=CACompromise ;;
+			ac|aff*) crl_reason=affiliationChanged ;;
+			ss|sup*) crl_reason=superseded ;;
+			co|ces*) crl_reason=cessationOfOperation ;;
+			ch|cer*) crl_reason=certificateHold ;;
+			*) user_error "\
+Unexpected reason: '$crl_reason'. See 'help revoke' for valid reasons."
+		esac
+	else
+		unset -v crl_reason
+	fi
+
+	# Enforce syntax
+	if [ "$1" ]; then
+		user_error "Syntax error: $1"
+	fi
+
+	# referenced cert must exist:
+	[ -f "$crt_in" ] || user_error "\
+Unable to revoke as no certificate was found.
+Certificate was expected at:
+* $crt_in"
+
+	# Set conflicting cert files: issued/ VS expired/ renewed/
+	crt_iss="$EASYRSA_PKI/issued/${file_name_base}.crt"
+	crt_exp="$EASYRSA_PKI/expired/${file_name_base}.crt"
+	crt_ren="$EASYRSA_PKI/renewed/issued/${file_name_base}.crt"
+
+	# If the command is 'revoke' then
+	# if an issued cert exists then check that the others do not
+	# To ensure that 'revoke' is not called accidentally
+	if [ "$cmd" = revoke ] && [ -f "$crt_iss" ]; then
+		if [ -f "$crt_exp" ] || [ -f "$crt_ren" ]; then
+			msg=
+			[ -f "$crt_exp" ] && msg="${NL}[Expired] $crt_exp"
+			[ -f "$crt_ren" ] && msg="${msg}${NL}[Renewed] $crt_ren"
+
+			# Force user to select revoke type
+			[ "$EASYRSA_BATCH" ] || user_error "\
+Conflicting file(s) found:${msg}
+
+Please select which type of 'revoke' command is required:
+* 'revoke-issued' will revoke a current certificate.
+* 'revoke-expired' will revoke an old cert, which has been expired.
+* 'revoke-renewed' will revoke an old cert, which has been renewed.
+
+Please see 'help revoke' for full details."
+		fi
+	fi
+	# Clear variables no longer in use
+	unset -v crt_iss crt_exp crt_ren
+
+	# Verify certificate
+	verify_file x509 "$crt_in" || user_error "\
+Unable to revoke as the input-file is not a valid certificate.
+Certificate was expected at:
+* $crt_in"
+
+	# Forbid self-signed cert from being expired/renewed/revoked
+	if forbid_selfsign "$crt_in"; then
+		user_error "Cannot $cmd a self-signed certificate."
+	fi
+
+	# Verify request
+	if [ -f "$req_in" ]; then
+		verify_file req "$req_in" || user_error "\
+Unable to verify request. The file is not a valid request.
+Request was expected at:
+* $req_in"
+	fi
+
+	# get the serial number of the certificate
+	cert_serial=
+	ssl_cert_serial "$crt_in" cert_serial || \
+		die "$cmd: Failed to get cert serial number!"
+
+	# Set out_dir
+	out_dir="$EASYRSA_PKI/revoked"
+	crt_out="$out_dir/certs_by_serial/${cert_serial}.crt"
+	key_out="$out_dir/private_by_serial/${cert_serial}.key"
+	req_out="$out_dir/reqs_by_serial/${cert_serial}.req"
+
+	# NEVER over-write a revoked cert, serial must be unique
+	deny_msg="\
+Cannot revoke this certificate, a conflicting file exists.
+*"
+	[ -f "$crt_out" ] && \
+		user_error "$deny_msg certificate: $crt_out"
+	[ -f "$key_out" ] && \
+		user_error "$deny_msg private key: $key_out"
+	[ -f "$req_out" ] && \
+		user_error "$deny_msg request    : $req_out"
+	unset -v deny_msg
+
+	# Check for key and request files
+	unset -v if_exist_key_in if_exist_req_in
+	if [ "$revoke_move_req_and_key" ] && [ -f "$key_in" ]; then
+		if_exist_key_in="
+* $key_in"
+	fi
+
+	if [ "$revoke_move_req_and_key" ] && [ -f "$req_in" ]; then
+		if_exist_req_in="
+* $req_in"
+	fi
+
+	# Set confirm DN and serial
+	confirm_dn="$(display_dn x509 "$crt_in")" || \
+		die "revoke: display_dn"
+	confirm_sn="    serial-number             = $cert_serial"
+
+	# confirm operation by displaying DN:
+	warn "\
+This process is destructive!
+
+These files will be MOVED to the 'revoked' sub-directory:
+* $crt_in${if_exist_key_in}${if_exist_req_in}
+
+These files will be DELETED:
+All PKCS files for commonName: $file_name_base
+
+The inline credentials files:
+* $inline_pub
+* $inline_pri"
+
+	# now confirm
+	confirm "  Continue with revocation: " "yes" "
+Please confirm that you wish to revoke the certificate
+with the following subject:
+
+$confirm_dn
+$confirm_sn
+
+    Reason: ${crl_reason:-None given}"
+
+	# Revoke certificate
+	easyrsa_openssl ca -utf8 -revoke "$crt_in" \
+		${crl_reason:+ -crl_reason "$crl_reason"} \
+		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+			|| die "\
+Failed to revoke certificate: revocation command failed."
+
+	# move revoked files
+	# so we can reissue certificates with the same name
+	revoke_move
+
+	notice "\
+                    * IMPORTANT *
+
+Revocation was successful. You must run 'gen-crl' and upload
+a new CRL to your infrastructure in order to prevent the revoked
+certificate from being accepted."
+} # => revoke()
+
+# revoke_move
+# moves revoked certificates to the 'revoked' folder
+# allows reissuing certificates with the same name
+revoke_move() {
+	mkdir -p \
+		"$EASYRSA_PKI"/revoked/reqs_by_serial \
+		"$EASYRSA_PKI"/revoked/certs_by_serial \
+		"$EASYRSA_PKI"/revoked/private_by_serial || \
+			die "revoke_move() - Failed to create 'revoked' directory."
+
+	# only move the req when revoking an issued cert
+	# and if we have the req
+	if [ "$revoke_move_req_and_key" ] && [ -f "$req_in" ]; then
+		mv "$req_in" "$req_out" || warn "Failed to move: $req_in"
+	fi
+
+	# move crt to revoked folder
+	mv "$crt_in" "$crt_out" || die "Failed to move: $crt_in"
+
+	# only move the key when revoking an issued cert
+	# and if we have the key
+	if [ "$revoke_move_req_and_key" ] && [ -f "$key_in" ]; then
+		mv "$key_in" "$key_out" || warn "Failed to move: $key_in"
+	fi
+
+	# remove any pkcs files
+	for pkcs in p12 p7b p8 p1; do
+		if [ -f "$in_dir/issued/$file_name_base.$pkcs" ]; then
+			# issued
+			rm "$in_dir/issued/$file_name_base.$pkcs" ||
+				warn "Failed to remove: $file_name_base.$pkcs"
+		fi
+
+		if [ -f "$in_dir/private/$file_name_base.$pkcs" ]; then
+			# private
+			rm "$in_dir/private/$file_name_base.$pkcs" ||
+				warn "Failed to remove: $file_name_base.$pkcs"
+		fi
+	done
+
+	# remove inline files
+	rm -f "$inline_pub" "$inline_pri" || warn \
+		"revoke_move - Error trying to remove inline files."
+} # => revoke_move()
+
+# Move expired cert out of pki/issued to pki/expired
+# to allow renewal
+expire_cert() {
+	# pull filename base:
+	[ "$1" ] || user_error "\
+Error: didn't find a file base name as the first argument.
+Run easyrsa without commands for usage and command help."
+
+	# Assign file_name_base and dust off!
+	file_name_base="$1"
+	shift
+
+	# input
+	in_dir="$EASYRSA_PKI/issued"
+	crt_in="$in_dir/$file_name_base.crt"
+
+	# output
+	out_dir="$EASYRSA_PKI/expired"
+	crt_out="$out_dir/$file_name_base.crt"
+
+	# make output folder
+	mkdir -p "$EASYRSA_PKI"/expired || \
+		die "expire_cert() - Failed to create 'expired' directory."
+
+	# Do not over write existing cert
+	if [ -f "$crt_out" ]; then
+		user_error "\
+Cannot expire this certificate, a conflicting file exists:
+* certificate: $crt_out
+
+Use command 'revoke-exired' to revoke this certificate."
+	fi
+
+	# deprecate ALL options
+	while [ "$1" ]; do
+		case "$1" in
+			nopass)
+				warn "\
+Option 'nopass' is not supported by command '$cmd'."
+				;;
+			*) user_error "Unknown option: $1"
+		esac
+		shift
+	done
+
+	# Verify certificate
+	if [ -f "$crt_in" ]; then
+		verify_file x509 "$crt_in" || user_error "\
+Input file is not a valid certificate:
+* $crt_in"
+	else
+		user_error "\
+Missing certificate file:
+* $crt_in"
+	fi
+
+	# Forbid self-signed cert from being expired/renewed/revoked
+	if forbid_selfsign "$crt_in"; then
+		user_error "Cannot $cmd a self-signed certificate."
+	fi
+
+	# get the serial number of the certificate
+	cert_serial=
+	ssl_cert_serial "$crt_in" cert_serial || \
+		die "$cmd: Failed to get cert serial number!"
+
+	# Set confirm DN and serial
+	confirm_dn="$(display_dn x509 "$crt_in")" || \
+		die "expire: display_dn"
+	confirm_sn="    serial-number             = $cert_serial"
+
+	# date of expiry
+	# Equal to: easyrsa-tools.lib - ssl_cert_not_after_date()
+	# This is left as a reminder that easyrsa does not handle
+	# dates well and they should be avoided, at all cost.
+	# This is for confirmation purposes ONLY.
+	crt_expire="$(
+		"$EASYRSA_OPENSSL" x509 -in "$crt_in" -noout -enddate
+		)" || die "expire: enddate"
+	confirm_ex="    notAfter date             = ${crt_expire#*=}"
+
+	# confirm
+	confirm "  Continue with expiry: " yes "
+Please confirm you wish to expire the certificate
+with the following subject:
+
+$confirm_dn
+
+$confirm_sn
+
+$confirm_ex" # => End confirm
+
+	# move cert to expired dir
+	mv "$crt_in" "$crt_out" || die "failed to move expired: $crt_in"
+
+	# User message
+	notice "\
+Certificate has been successfully moved to the expired directory.
+* $crt_out
+
+This certificate is still valid, until it expires.
+It can be revoked with command 'revoke-expired'.
+
+It is now possible to sign a new certificate for '$file_name_base'"
+} # => expire_cert()
+
+# Forbid an EasyRSA self-signed cert from being expired/renewed/revoked
+# by a CA that has nothing to do with the cert
+# EasyRSA built self signed certs are forced to always specify
+# the issuer cert serial, using built-in X509-type file 'selfsign'.
+# All other certs pass this test, even without a signing serial.
+forbid_selfsign() {
+	# cert temp-file
+	forbid_ss_tmp=
+	easyrsa_mktemp forbid_ss_tmp
+
+	forbid_serial=
+	ssl_cert_serial "$1" forbid_serial || \
+		die "forbid_selfsign - ssl_cert_serial"
+
+	# SSL text
+	"$EASYRSA_OPENSSL" x509 -in "$1" -noout -text > "$forbid_ss_tmp" || \
+		die "forbid_selfsign - ssl text"
+
+	# Extract signing cert serial
+	signing_serial="$(
+			grep "^[[:blank:]]*serial:.*$" "$forbid_ss_tmp" | \
+				sed -e 's/^[[:blank:]]*serial//' -e 's/://g'
+		)" || die "forbid_selfsign - signing_serial subshell"
+	verbose "forbid_selfsign; $forbid_serial = $signing_serial"
+
+	# Compare $ssl_cert_serial to $signing_serial
+	[ "$forbid_serial" = "$signing_serial" ]
+} # => forbid_selfsign()
+
+# gen-crl backend
+gen_crl() {
+	out_file="$EASYRSA_PKI/crl.pem"
+	out_der="$EASYRSA_PKI/crl.der"
+
+	out_file_tmp=""
+	easyrsa_mktemp out_file_tmp
+
+	if [ -r "$out_file" ]; then
+		cp -p "$out_file" "$out_file_tmp" || \
+			warn "Failed to preserve CRL file permissions."
+	fi
+
+	easyrsa_openssl ca -utf8 -gencrl -out "$out_file_tmp" \
+		${EASYRSA_CRL_DAYS:+ -crldays "$EASYRSA_CRL_DAYS"} \
+		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} || \
+			die "CRL Generation failed."
+
+	# Move temp-files to target-files
+	cp -p "$out_file_tmp" "$out_file" || die "Failed to move temp CRL file."
+
+	# Copy to DER - As published by OpenSSL
+	if "$EASYRSA_OPENSSL" crl -in "$out_file" -out "$out_der" \
+		-outform DER
+	then
+		crl_der_note="An updated CRL DER copy has been created:
+* $out_der"
+	else
+		crl_der_note="Failed to create CRL DER copy!"
+	fi
+
+	notice "\
+$crl_der_note
+
+An updated CRL has been created:
+* $out_file
+
+IMPORTANT: When the CRL expires, an OpenVPN Server which uses a
+CRL will reject ALL new connections, until the CRL is replaced."
+} # => gen_crl()
+
+# import-req backend
+import_req() {
+	# pull passed paths
+	in_req="$1"
+	short_name="$2"
+	out_req="$EASYRSA_PKI/reqs/$2.req"
+
+	[ "$short_name" ] || user_error "\
+Unable to import: incorrect command syntax.
+Run easyrsa without commands for usage and command help."
+
+	# Request file must exist
+	[ -f "$in_req" ] || user_error "\
+No request found for the input: '$2'
+Expected to find the request at:
+* $in_req"
+
+	verify_file req "$in_req" || user_error "\
+The certificate request file is not in a valid X509 format:
+* $in_req"
+
+	# destination must not exist
+	[ -f "$out_req" ] && user_error "\
+Please choose a different name for your imported request file.
+Conflicting file already exists at:
+* $out_req"
+
+	# now import it
+	cp "$in_req" "$out_req"
+
+	notice "\
+Request successfully imported with short-name: $short_name
+This request is now ready to be signed."
+} # => import_req()
+
+# import external CA to pki/inline/external-ca.list
+# for use by intermediate CA, inline files
+import_ca() {
+	# pull passed paths
+	in_ext_ca="$1"
+
+	# CA file must exist
+	[ -f "$in_ext_ca" ] || user_error "\
+Missing file: '$in_ext_ca'"
+
+	verify_file x509 "$in_ext_ca" || user_error "\
+The certificate file is not in a valid X509 format:
+* $in_ext_ca"
+
+	# External CA list file
+	external_ca_list="$EASYRSA_PKI"/inline/external-ca.list
+
+	# Create 'pki/inline' directory
+	mkdir -p "$EASYRSA_PKI"/inline || \
+		die "import_ca() - failed to create 'inline' directory."
+
+	# tmp-file for imported CA
+	ext_ca_tmp=
+	easyrsa_mktemp ext_ca_tmp
+
+	# Write External CA data to tmp-file
+	# LibreSSL issue: https://github.com/libressl/portable/issues/1228
+	# opts support
+	cert_opts=
+	name_opts="utf8,sep_multiline,space_eq,lname,align"
+	if [ "$ssl_lib_name" = libressl ]; then
+		verbose "Extract full text CA for _$ssl_lib_name_"
+		"$EASYRSA_OPENSSL" x509 -in "$in_ext_ca" \
+			-text -nameopt "$name_opts" -certopt "$cert_opts" \
+			>"$ext_ca_tmp" || \
+				die "import_ca() - OpenSSL failure to process the input"
+	else
+		easyrsa_openssl x509 -in "$in_ext_ca" -out "$ext_ca_tmp" \
+			-text -nameopt "$name_opts" -certopt "$cert_opts" || \
+				die "import_ca() - OpenSSL failure to process the input"
+	fi
+
+	# TODO: Verify Root CA chain
+	# ---------------------------
+
+	# create external CA list file with header
+	if [ ! -f "$external_ca_list" ]; then
+		header="# Easy-RSA Inline file: External CA list"
+		print "$header" >"$external_ca_list" || \
+			die "import_ca() - failed to create list file."
+	fi
+
+	# now import it
+	cat "$ext_ca_tmp" >>"$external_ca_list" || \
+		die "import_ca() - failed to write list file."
+
+	notice "\
+External CA successfully imported into: $external_ca_list"
+} # => import_ca()
+
+# import external TLS Key to pki/private/easyrsa-tls.key
+# for use by inline files
+import_tls_key() {
+	# pull passed paths
+	in_ext_tls_key="$1"
+
+	# imported tls_key file
+	out_ext_tls_key="$EASYRSA_PKI"/private/easyrsa-tls.key
+
+	# in_ext_tls_key file must exist
+	[ -f "$in_ext_tls_key" ] || user_error "\
+Cannot read from missing file: '$in_ext_tls_key'"
+
+	# out_ext_tls_key file must exist
+	[ ! -f "$out_ext_tls_key" ] || user_error "\
+Cannot write to existing file: '$out_ext_tls_key'"
+
+	# Create 'pki/private' directory
+	mkdir -p "$EASYRSA_PKI"/private || \
+		die "import_tls_key() - failed to create 'private' directory."
+
+	# Force noclobber
+	set_no_clobber on import_tls_key
+
+	# now import it
+	cat "$in_ext_tls_key" >"$out_ext_tls_key" || \
+		die "import_tls_key() - failed to import TLS Key."
+
+	# Force noclobber
+	set_no_clobber off import_tls_key
+
+	notice "\
+External TLS Key successfully imported into: $out_ext_tls_key"
+} # => import_tls_key()
+
+# export pkcs#12, pkcs#7, pkcs#8 or pkcs#1
+export_pkcs() {
+	pkcs_type="$1"
+	shift
+
+	[ "$1" ] || user_error "\
+Unable to export '$pkcs_type': incorrect command syntax.
+Run easyrsa without commands for usage and command help."
+
+	file_name_base="$1"
+	shift
+
+	crt_in="$EASYRSA_PKI/issued/$file_name_base.crt"
+	key_in="$EASYRSA_PKI/private/$file_name_base.key"
+	crt_ca="$EASYRSA_PKI/ca.crt"
+
+	# Always set a friendly_name
+	set_var EASYRSA_P12_FR_NAME "$file_name_base"
+	friendly_name="$EASYRSA_P12_FR_NAME"
+
+	# opts support
+	cipher=-aes256
+	want_ca=1
+	want_key=1
+	unset -v nokeys legacy
+
+	# Under OpenSSL 1.1, use the PBE/MAC algorithms OpenSSL 3.0 uses,
+	# unless "legacy" is set.  This makes the .p12 files readable by
+	# OpenSSL 3.0 without needing '-legacy'.
+	if [ "$openssl_v3" ]; then
+		# No cipher opts required
+		unset -v p12_keypbe p12_certpbe p12_macalg
+	else
+		# Upgrade PBE & MAC opts - Reset by option 'legacy'
+		p12_keypbe=AES-256-CBC
+		p12_certpbe=AES-256-CBC
+		p12_macalg=sha256
+	fi
+
+	while [ "$1" ]; do
+		case "$1" in
+			noca)
+				want_ca=""
+				;;
+			nokey)
+				want_key=""
+				# Undocumented OpenSSL feature: option
+				# -nokeys will ignore missing -inkey file
+				# No doubt, the reason for the extra -inkey
+				nokeys=-nokeys
+				;;
+			nopass)
+				[ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1
+				;;
+			nofn)
+				friendly_name=""
+				;;
+			legacy)
+				if [ "$openssl_v3" ]; then
+					# OpenSSL v3 requires providers/legacy.so
+					# EasyRSA can use OPENSSL_MODULES=/path-to/providers
+					legacy=-legacy
+				else
+					# Downgrade PBE & MAC opts
+					unset -v p12_keypbe p12_certpbe p12_macalg
+				fi
+				;;
+			*)
+				user_error "Unknown command option: '$1'"
+		esac
+		shift
+	done
+
+	# Required options - PKCS, rhymes with mess
+	case "$pkcs_type" in
+		p12|p7)
+			: # ok
+			;;
+		p8|p1)
+			want_key=1
+			;;
+		*) die "Unknown PKCS type: $pkcs_type"
+	esac
+
+	# Check for CA, if required
+	if [ "$want_ca" ]; then
+		case "$pkcs_type" in
+		p12|p7)
+			# verify_ca_init() here, otherwise not required
+			if verify_ca_init test; then
+				: # ok
+			else
+				warn "\
+Missing CA Certificate, expected at:
+* $crt_ca"
+				confirm "
+  Continue without CA Certificate (EG: option 'noca') ? " yes "
+Your PKI does not include a CA Certificate.
+You can export your User Certificate to a $pkcs_type file
+but the CA Certificate will not be included."
+
+				# --batch mode does not allow
+				# on-the-fly command changes
+				if [ "$EASYRSA_BATCH" ]; then
+					die "export-$pkcs_type: Missing CA"
+				fi
+				want_ca=""
+			fi
+			;;
+		p8|p1)
+			: # Not required
+			;;
+		*) die "Unknown PKCS type: $pkcs_type"
+		esac
+	fi
+
+	# Check for key, if required
+	if [ "$want_key" ]; then
+		if [ -f "$key_in" ]; then
+			: #ok
+		else
+			case "$pkcs_type" in
+			p12)
+				warn "\
+Missing Private Key, expected at:
+* $key_in"
+				confirm "
+  Continue without Private Key (EG: option 'nokey') ? " yes "
+Your PKI does not include a Private Key for '$file_name_base'.
+You can export your User Certificate to a '$pkcs_type' file
+but the Private Key will not be included."
+
+				# --batch mode does not allow
+				# on-the-fly command changes
+				if [ "$EASYRSA_BATCH" ]; then
+					die "export-$pkcs_type: Missing key"
+				fi
+				nokeys=-nokeys
+				;;
+			p8|p1)
+				user_error "\
+Missing Private Key, expected at:
+* $key_in"
+				;;
+			p7)
+				: # Not required
+				;;
+			*) die "Unknown PKCS type: $pkcs_type"
+			esac
+		fi
+	fi
+
+	# Check for certificate, if required
+	if [ -f "$crt_in" ]; then
+		: # ok
+	else
+		case "$pkcs_type" in
+		p12|p7)
+			user_error "\
+Missing User Certificate, expected at:
+* $crt_in"
+			;;
+		p8|p1)
+			: # Not required
+			;;
+		*) die "Unknown PKCS type: $pkcs_type"
+		esac
+	fi
+
+	# For 'nopass' PKCS requires an explicit empty password
+	if [ "$EASYRSA_NO_PASS" ]; then
+		EASYRSA_PASSIN=pass:
+		EASYRSA_PASSOUT=pass:
+		unset -v cipher # pkcs#1 only
+	fi
+
+	# Complete export
+	case "$pkcs_type" in
+	p12)
+		pkcs_out="${EASYRSA_PKI}/private/${file_name_base}.p12"
+		# Only PKCS12 can be inlined for OpenVPN
+		inline_dir="$EASYRSA_PKI"/inline/private
+		inline_out="${inline_dir}/${file_name_base}".inline-p12
+
+		[ "$legacy" ] && \
+			error_info="SSL library may not support -legacy mode"
+
+		verbose "export-p12: cipher opts: \
+-keypbe=$p12_keypbe | -certpbe=$p12_certpbe | -macalg=$p12_macalg"
+
+		# export the p12:
+		easyrsa_openssl pkcs12 -export \
+			-in "$crt_in" \
+			-out "$pkcs_out" \
+			-inkey "$key_in" \
+			${nokeys} \
+			${legacy} \
+			${p12_keypbe:+ -keypbe "$p12_keypbe"} \
+			${p12_certpbe:+ -certpbe "$p12_certpbe"} \
+			${p12_macalg:+ -macalg "$p12_macalg"} \
+			${friendly_name:+ -name "$friendly_name"} \
+			${want_ca:+ -certfile "$crt_ca"} \
+			${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+			${EASYRSA_PASSOUT:+ -passout "$EASYRSA_PASSOUT"} \
+				|| die "Failed to export PKCS#12 - $error_info"
+
+		# Inline pkcs12
+		if inline_file p12 "$file_name_base" "$pkcs_out"; then
+			[ "$EASYRSA_NO_INLINE" ] || notice "\
+A BASE64 encoded inline file has also been created at:
+* ${inline_out}"
+		else
+			warn "export_pkcs: inline_file p12 FAILED"
+		fi
+		;;
+	p7)
+		pkcs_out="$EASYRSA_PKI/issued/$file_name_base.p7b"
+
+		# export the p7:
+		easyrsa_openssl crl2pkcs7 -nocrl \
+			-certfile "$crt_in" \
+			-out "$pkcs_out" \
+			${want_ca:+ -certfile "$crt_ca"} \
+				|| die "Failed to export PKCS#7"
+		;;
+	p8)
+		pkcs_out="$EASYRSA_PKI/private/$file_name_base.p8"
+
+		# export the p8:
+		easyrsa_openssl pkcs8 -topk8 \
+			-in "$key_in" \
+			-out "$pkcs_out" \
+			${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+			${EASYRSA_PASSOUT:+ -passout "$EASYRSA_PASSOUT"} \
+				|| die "Failed to export PKCS#8"
+		;;
+	p1)
+		pkcs_out="$EASYRSA_PKI/private/$file_name_base.p1"
+
+		# OpenSSLv3 requires -traditional for PKCS#1
+		# Otherwise, OpenSSLv3 outputs PKCS#8
+		[ "$verify_ssl_lib_ok" ] || \
+			die "export_pkcs.p1: verify_ssl_lib_ok FAIL"
+
+		if [ "$openssl_v3" ]; then
+			traditional=-traditional
+		else
+			unset -v traditional
+		fi
+
+		# export the p1:
+		easyrsa_openssl rsa \
+			-in "$key_in" \
+			-out "$pkcs_out" \
+			${traditional} \
+			${cipher} \
+			${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+			${EASYRSA_PASSOUT:+ -passout "$EASYRSA_PASSOUT"} \
+				|| die "Failed to export PKCS#1"
+	;;
+	*) die "Unknown PKCS type: $pkcs_type"
+	esac
+
+	# User messages
+	notice "\
+Successful export of $pkcs_type file. Your exported file is at:
+* $pkcs_out"
+} # => export_pkcs()
+
+# set-pass backend
+set_pass() {
+	# values supplied by the user:
+	raw_file="$1"
+	file="$EASYRSA_PKI/private/$raw_file.key"
+
+	if [ "$raw_file" ]; then
+		shift
+	else
+		user_error "\
+Missing argument: no name/file supplied."
+	fi
+
+	# parse command options
+	cipher="-aes256"
+	while [ "$1" ]; do
+		case "$1" in
+			nopass)
+				[ "$prohibit_no_pass" ] || EASYRSA_NO_PASS=1
+				;;
+			file)
+				file="$raw_file"
+				;;
+			*) user_error "Unknown command option: '$1'"
+		esac
+		shift
+	done
+
+	# If nopass then do not encrypt else encrypt with password.
+	if [ "$EASYRSA_NO_PASS" ]; then
+		unset -v cipher
+	fi
+
+	[ -f "$file" ] || user_error "\
+Missing private key: expected to find the private key file at:
+* $file"
+
+	notice "\
+If the key is encrypted then you must supply the current password.
+${cipher:+You will then enter a new password for this key.$NL}"
+
+	# Set password
+	out_key_tmp=""
+	easyrsa_mktemp out_key_tmp
+
+	easyrsa_openssl pkey -in "$file" -out "$out_key_tmp" \
+		${cipher:+ "$cipher"} \
+		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+		${EASYRSA_PASSOUT:+ -passout "$EASYRSA_PASSOUT"} || \
+			die "Failed to change the private key passphrase."
+
+	# Move old key-file out of the way
+	mv "$file" "${file}.tmp" || \
+		die "Failed to move the old-key file."
+
+	# Move new key-file into place
+	if mv "$out_key_tmp" "$file"; then
+		rm -f "${file}.tmp"
+	else
+		mv -f "${file}.tmp" "$file"
+		die "Failed to update the private key file."
+	fi
+
+	key_update=changed
+	[ "$EASYRSA_NO_PASS" ] && key_update=removed
+	notice "Key passphrase successfully $key_update"
+} # => set_pass()
+
+# Verify OpenVPN binary
+verify_openvpn() {
+	if [ -f "$EASYRSA_OPENVPN" ]; then
+		verbose "verify_openvpn; Preset EASYRSA_OPENVPN='$EASYRSA_OPENVPN'"
+		return
+	fi
+
+	# Try to find openvpn *nix
+	if which openvpn >/dev/null 2>&1; then
+		set_var EASYRSA_OPENVPN "$(which openvpn)"
+	else
+		# Try to find openvpn.exe, specifically for Windows
+		# Assign temp-file for Windows path name
+		ovpn_path_tmp=""
+		easyrsa_mktemp ovpn_path_tmp
+
+		if which openvpn.exe > "$ovpn_path_tmp"; then
+			# shellcheck disable=SC1003 # (info): Want to escape a single quote?
+			ovpn_path="$(sed s/'\\'/'\/'/ "$ovpn_path_tmp")" || \
+				die "verify_openvpn - Failed to convert openvpn path."
+			set_var EASYRSA_OPENVPN "$ovpn_path"
+		else
+			user_error "\
+An 'openvpn' binary is not in your system PATH.
+EasyRSA can not generate OpenVPN TLS keys."
+		fi
+	fi
+	verbose "verify_openvpn; Set EASYRSA_OPENVPN='$EASYRSA_OPENVPN'"
+} # => verify_openvpn()
+
+# OpenVPN TLS Auth/Crypt Key
+tls_key_gen() {
+	case "$1" in
+		tls-crypt-v2)
+			print "Unavailable."
+			cleanup
+		;;
+		tls-crypt) tls_key_type=TLS-CRYPT ;;
+		tls-auth) tls_key_type=TLS-AUTH ;;
+		*) die "Unknown key type: '$1'"
+	esac
+
+	# Over write error message
+	tls_key_error_msg="
+If this file is changed then it MUST be redistributed to ALL servers
+AND clients, to be in effect. Do NOT change this existing file."
+
+	# Assign possible TLS key sources
+	tls_key_file="$EASYRSA_PKI"/private/easyrsa-tls.key
+	old_tls_key_file="$EASYRSA_PKI"/easyrsa-keepsafe-tls.key
+
+	# Forbid overwrite - default TLS key
+	if [ -f "$tls_key_file" ]; then
+		tls_key_data="$(cat "$tls_key_file")"
+		case "$tls_key_data" in
+			*'TLS-CRYPT'*) tls_key_type=TLS-CRYPT ;;
+			*'TLS-AUTH'*) tls_key_type=TLS-AUTH ;;
+			*) tls_key_type=UNKNOWN
+		esac
+
+		user_error "\
+Cannot overwrite existing $tls_key_type Key:
+* $tls_key_file
+$tls_key_error_msg"
+	fi
+
+	# Forbid overwrite - Old TLS key
+	if [ -f "$old_tls_key_file" ]; then
+		old_tls_key_data="$(cat "$old_tls_key_file")"
+		case "$old_tls_key_data" in
+			*'TLS-CRYPT'*) tls_key_type=TLS-CRYPT ;;
+			*'TLS-AUTH'*) tls_key_type=TLS-AUTH ;;
+			*) tls_key_type=UNKNOWN
+		esac
+
+		user_error "\
+Cannot overwrite existing $tls_key_type Key:
+* $old_tls_key_file
+$tls_key_error_msg"
+	fi
+
+	verify_openvpn
+
+	tls_key_tmp=
+	easyrsa_mktemp tls_key_tmp
+
+	# Generate TLS Key
+	"$EASYRSA_OPENVPN" --genkey "$1" "$tls_key_tmp" || \
+		die "tls_key_gen - --genkey $tls_key_type FAIL"
+
+	# Insert type label
+	{
+		print "# Easy-RSA $tls_key_type Key"
+		cat "$tls_key_tmp"
+	} > "$tls_key_file" || \
+			die "tls_key_gen - Insert type label FAIL"
+
+	notice "\
+$tls_key_type Key generated at:
+* $tls_key_file
+$tls_key_error_msg"
+	verbose "tls_key_gen: openvpn --genkey $tls_key_type OK"
+} # => tls_key_gen()
+
+# Get certificate start date
+# shellcheck disable=2317 # Unreach - ssl_cert_not_before_date()
+ssl_cert_not_before_date() {
+	verbose "ssl_cert_not_before_date; DEPRECATED"
+	[ "$#" = 2 ] || die "\
+ssl_cert_not_before_date - input error"
+	[ -f "$1" ] || die "\
+ssl_cert_not_before_date - missing cert"
+
+	fn_ssl_out="$(
+		"$EASYRSA_OPENSSL" x509 -in "$1" -noout -startdate
+		)" || die "\
+ssl_cert_not_before_date - failed: -startdate"
+
+	fn_ssl_out="${fn_ssl_out#*=}"
+
+	force_set_var "$2" "$fn_ssl_out" || die "\
+ssl_cert_not_before_date - failed to set var '$*'"
+
+	unset -v fn_ssl_out
+} # => ssl_cert_not_before_date()
+
+# Get certificate end date
+ssl_cert_not_after_date() {
+	verbose "ssl_cert_not_after_date; DEPRECATED"
+	[ "$#" = 2 ] || die "\
+ssl_cert_not_after_date - input error"
+	[ -f "$1" ] || die "\
+ssl_cert_not_after_date - missing cert"
+
+	fn_ssl_out="$(
+		"$EASYRSA_OPENSSL" x509 -in "$1" -noout -enddate
+		)" || die "\
+ssl_cert_not_after_date - failed: -enddate"
+
+	fn_ssl_out="${fn_ssl_out#*=}"
+
+	force_set_var "$2" "$fn_ssl_out" || die "\
+ssl_cert_not_after_date - failed to set var '$*'"
+
+	unset -v fn_ssl_out
+} # => ssl_cert_not_after_date()
+
+# SSL -- v3 -- startdate iso_8601
+# shellcheck disable=2317 # Unreach - iso_8601_cert_startdate()
+iso_8601_cert_startdate() {
+	verbose "iso_8601_cert_startdate; NEW"
+	[ "$#" = 2 ] || die "\
+iso_8601_cert_startdate: input error"
+	[ -f "$1" ] || die "\
+iso_8601_cert_startdate: missing cert"
+
+	# On error return, let the caller decide what to do
+	if fn_ssl_out="$(
+		"$EASYRSA_OPENSSL" x509 -in "$1" -noout \
+			-startdate -dateopt iso_8601
+		)"
+	then
+		: # ok
+	else
+		# The caller MUST assess this error
+		verbose "iso_8601_cert_startdate; GENERATED ERROR"
+		return 1
+	fi
+
+	fn_ssl_out="${fn_ssl_out#*=}"
+
+	force_set_var "$2" "$fn_ssl_out" || die "\
+iso_8601_cert_startdate: failed to set var '$*'"
+
+	unset -v fn_ssl_out
+} # => iso_8601_cert_startdate()
+
+# SSL -- v3 -- enddate iso_8601
+iso_8601_cert_enddate() {
+	verbose "iso_8601_cert_enddate; NEW"
+	[ "$#" = 2 ] || die "\
+iso_8601_cert_enddate: input error"
+	[ -f "$1" ] || die "\
+iso_8601_cert_enddate: missing cert"
+
+	# On error return, let the caller decide what to do
+	if fn_ssl_out="$(
+		"$EASYRSA_OPENSSL" x509 -in "$1" -noout \
+			-enddate -dateopt iso_8601 2>/dev/null
+		)"
+	then
+		: # ok
+	else
+		# The caller MUST assess this error
+		verbose "iso_8601_cert_enddate; GENERATED ERROR"
+		return 1
+	fi
+
+	fn_ssl_out="${fn_ssl_out#*=}"
+
+	force_set_var "$2" "$fn_ssl_out" || die "\
+iso_8601_cert_enddate: failed to set var '$*'"
+
+	unset -v fn_ssl_out
+} # => iso_8601_cert_enddate()
+
+# Build an iso_8601 date from database data
+db_date_to_iso_8601() {
+	# check input
+	[ "$#" = 2 ] || \
+		die "db_date_to_iso_8601: input error"
+
+	# Expected format: '230612235959Z'
+	in_date="$1"
+	verbose "db_date_to_iso_8601; in_date=$in_date"
+
+	# Check length
+	[ "${#in_date}" = 13 ] || \
+		die "db_date_to_iso_8601: input length"
+
+	# yyyy is expected to be only 'yy'
+	yyyy="${in_date%???????????}"
+	in_date="${in_date#??}"
+
+	# Prepend century based on value - Valid until 2070
+	yyyy="${yyyy#0}" # drop a leading zero
+	if [ "$yyyy" -lt 70 ]; then
+		# 20th century
+		if [ "${#yyyy}" = 2 ]; then
+			yyyy=20"${yyyy}"
+		else
+			yyyy=200"${yyyy}"
+		fi
+	else
+		# 19th century
+		if [ "${#yyyy}" = 2 ]; then
+			yyyy=19"${yyyy}"
+		else
+			yyyy=190"${yyyy}"
+		fi
+	fi
+
+	# Consume remaining two digit strings and Timezone
+	mm="${in_date%?????????}"
+	in_date="${in_date#??}"
+	dd="${in_date%???????}"
+	in_date="${in_date#??}"
+	HH="${in_date%?????}"
+	in_date="${in_date#??}"
+	MM="${in_date%???}"
+	in_date="${in_date#??}"
+	SS="${in_date%?}"
+	in_date="${in_date#??}"
+	TZ="$in_date"
+
+	# Assign iso_8601 date
+	out_date="${yyyy}-${mm}-${dd} ${HH}:${MM}:${SS}${TZ}"
+	verbose "db_date_to_iso_8601; out_date=$out_date"
+
+	# Return out_date
+	force_set_var "$2" "$out_date" || \
+		die "db_date_to_iso_8601: force_set_var $2 $out_date"
+
+	unset -v in_date out_date yyyy mm dd HH MM SS TZ
+} # => db_date_to_iso_8601()
+
+# Certificate expiry
+will_cert_be_valid() {
+	# Verify file exists and is a valid cert
+	[ -f "$1" ] || \
+		die "will_cert_be_valid - Missing file: $1"
+	verify_file x509 "$1" || \
+		die "will_cert_be_valid - Invalid file: $1"
+
+	# Verify --days
+	case "$2" in
+		0) : ;; # ok
+		''|*[!1234567890]*|0*)
+			die "will_cert_be_valid - Non-decimal value: $2"
+	esac
+
+	# is the cert still valid at this future date
+	ssl_out="$(
+		"$EASYRSA_OPENSSL" x509 -in "$1" -checkend "$2"
+	)"
+
+	# analyse SSL output
+	case "$ssl_out" in
+		'Certificate will not expire') return 0 ;;
+		'Certificate will expire') return 1 ;;
+		*) die "will_cert_be_valid - Failure: '$ssl_out'"
+	esac
+} # => will_cert_be_valid()
+
+# Read db
+# shellcheck disable=SC2295 # nested expand - read_db()
+read_db() {
+	TCT='	' # tab character
+	db_in="$EASYRSA_PKI/index.txt"
+	pki_r_issued="$EASYRSA_PKI/renewed/issued"
+	pki_r_by_sno="$EASYRSA_PKI/renewed/certs_by_serial"
+	unset -v target_found
+
+	while read -r db_status db_notAfter db_record; do
+
+		# Quiet schellcheck
+		# SC2034 (warning): db_notAfter appears unused
+		unused="$db_notAfter"
+		db_notAfter="$unused"
+		unset -v db_notAfter unused
+
+		verbose "***** Read next record *****"
+
+		# Recreate temp-session and
+		# drop edits to SSL Conf file
+		remove_secure_session
+		secure_session
+		locate_support_files
+		select_ssl_cnf_tmp
+		write_global_safe_ssl_cnf_tmp
+
+		# Interpret the db/certificate record
+		unset -v db_serial db_cn db_revoke_date db_reason
+		case "$db_status" in
+		V|E)
+			# Valid
+			db_serial="${db_record%%${TCT}*}"
+			db_record="${db_record#*${TCT}}"
+			db_cn="${db_record#*/CN=}"; db_cn="${db_cn%%/*}"
+			cert_issued="$EASYRSA_PKI/issued/$db_cn.crt"
+			cert_r_issued="$pki_r_issued/$db_cn.crt"
+			cert_r_by_sno="$pki_r_by_sno/$db_serial.crt"
+		;;
+		R)
+			# Revoked
+			db_revoke_date="${db_record%%${TCT}*}"
+			db_reason="${db_revoke_date#*,}"
+			if [ "$db_reason" = "$db_revoke_date" ]; then
+				db_reason="None given"
+			else
+				db_revoke_date="${db_revoke_date%,*}"
+			fi
+			db_record="${db_record#*${TCT}}"
+
+			db_serial="${db_record%%${TCT}*}"
+			db_record="${db_record#*${TCT}}"
+			db_cn="${db_record#*/CN=}"; db_cn="${db_cn%%/*}"
+		;;
+		*) die "Unexpected status: $db_status"
+		esac
+
+		# Output selected status report for this record
+		case "$report" in
+		expire)
+		# Certs which expire before EASYRSA_PRE_EXPIRY_WINDOW days
+			case "$db_status" in
+			V|E)
+				case "$target" in
+				'') expire_status_v2 "$cert_issued" ;;
+				*)
+					if [ "$target" = "$db_cn" ]; then
+						expire_status_v2 "$cert_issued"
+					fi
+				esac
+			;;
+			*)
+				: # Ignore ok
+			esac
+		;;
+		revoke)
+		# Certs which have been revoked
+			case "$db_status" in
+			R)
+				case "$target" in
+				'') revoke_status ;;
+				*)
+					if [ "$target" = "$db_cn" ]; then
+						revoke_status
+					fi
+				esac
+			;;
+			*)
+				: # Ignore ok
+			esac
+		;;
+		renew)
+		# Certs which have been renewed but not revoked
+			case "$db_status" in
+			V|E)
+				case "$target" in
+				'') renew_status ;;
+				*)
+					if [ "$target" = "$db_cn" ]; then
+						renew_status
+					fi
+				esac
+			;;
+			*)
+				: # Ignore ok
+			esac
+		;;
+		*) die "Unrecognised report: $report"
+		esac
+
+		# Is db record for target found
+		if [ "$target" = "$db_cn" ]; then
+			target_found=1
+		fi
+
+	done < "$db_in"
+
+	# Add CA to show-expire
+	case  "$report" in
+	expire)
+		# Extract -endate
+		ca_enddate="$(
+			"$EASYRSA_OPENSSL" x509 -in "$EASYRSA_PKI"/ca.crt \
+				-noout -enddate
+		)"
+		ca_enddate="${ca_enddate#*=}"
+
+		# Check CA for expiry
+		if will_cert_be_valid "$EASYRSA_PKI"/ca.crt \
+			"$pre_expire_window_s"
+		then
+			: # cert will still be valid by expiry window
+		else
+			# Print CA expiry date
+			printf '\n%s\n\n' \
+				"CA certificate will expire on $ca_enddate"
+		fi
+	esac
+
+	# Check for target found/valid commonName, if given
+	if [ "$target" ]; then
+		[ "$target_found" ] || \
+			warn "Certificate for $target was not found"
+	fi
+} # => read_db()
+
+# Expire status
+expire_status_v2() {
+	# The certificate for CN should exist but may not
+	if [ -f "$1" ]; then
+		verbose "expire_status_v2; cert exists"
+
+		# Check if cert will be valid else print details
+		if will_cert_be_valid "$1" "$pre_expire_window_s"
+		then
+			verbose "expire_status_v2; cert will still be valid"
+		else
+			# cert expiry date
+			cert_not_after_date=
+			if iso_8601_cert_enddate "$1" cert_not_after_date; then
+				: # ok
+			else
+				# Standard date - OpenSSL v1
+				ssl_cert_not_after_date "$1" cert_not_after_date
+			fi
+
+			# show expiring cert details
+			printf '%s%s\n' \
+				"$db_status | Serial: $db_serial | " \
+				"$cert_not_after_date | CN: $db_cn"
+		fi
+	else
+		verbose "expire_status_v2; issued cert does not exist"
+	fi
+} # => expire_status_v2()
+
+# Revoke status
+revoke_status() {
+	# Translate db date to usable date
+	cert_revoke_date=
+	# eg: 220517142247Z --> 2022-05-17 14:22:47Z
+	db_date_to_iso_8601 "$db_revoke_date" cert_revoke_date
+
+	printf '%s%s%s\n' \
+		"$db_status | Serial: $db_serial | " \
+		"Revoked: $cert_revoke_date | " \
+		"Reason: $db_reason | CN: $db_cn"
+} # => revoke_status()
+
+# Renewed status
+# renewed certs only remain in the renewed folder until revoked
+# Only ONE renewed cert with unique CN can exist in renewed folder
+renew_status() {
+	# Does a Renewed cert exist ?
+	# files in issued are file name, or in serial are SerialNumber
+	unset -v \
+		cert_file_in cert_is_issued cert_is_serial renew_is_old
+
+	# Find renewed/issued/CN
+	if [ -f "$cert_r_issued" ]; then
+		cert_file_in="$cert_r_issued"
+		cert_is_issued=1
+	fi
+
+	# Find renewed/cert_by_serial/SN
+	if [ -f "$cert_r_by_sno" ]; then
+		cert_file_in="$cert_r_by_sno"
+		cert_is_serial=1
+		renew_is_old=1
+	fi
+
+	# Both should not exist
+	if [ "$cert_is_issued" ] && [ "$cert_is_serial" ]; then
+		die "Too many certs"
+	fi
+
+	# If a renewed cert exists
+	if [ "$cert_file_in" ]; then
+		# get the serial number of the certificate
+		ssl_cert_serial "$cert_file_in" cert_serial
+
+		# db serial must match certificate serial, otherwise
+		# this is an issued cert that replaces a renewed cert
+		if [ "$db_serial" != "$cert_serial" ]; then
+			information "\
+serial mismatch:
+  db_serial:    $db_serial
+  cert_serial:  $cert_serial
+  cert_file_in: $cert_file_in"
+			return 0
+		fi
+
+		# Use cert date
+		# Assigns cert_not_after_date
+		ssl_cert_not_after_date \
+			"$cert_file_in" cert_not_after_date
+
+		# Highlight renewed/cert_by_serial
+		if [ "$renew_is_old" ]; then
+			printf '%s%s\n' \
+				"*** $db_status | Serial: $db_serial | " \
+				"Expires: $cert_not_after_date | CN: $db_cn"
+		else
+			printf '%s%s\n' \
+				"$db_status | Serial: $db_serial | " \
+				"Expires: $cert_not_after_date | CN: $db_cn"
+		fi
+
+	else
+		# Cert is valid but not renewed
+		: # ok - ignore
+	fi
+} # => renew_status()
+
+# cert status reports
+status() {
+	[ "$#" -gt 0 ] || die "status - input error"
+	report="$1"
+	target="$2"
+
+	# test fix: https://github.com/OpenVPN/easy-rsa/issues/819
+	export LC_TIME=C.UTF-8
+
+	# expiry seconds
+	pre_expire_window_s="$((
+		EASYRSA_PRE_EXPIRY_WINDOW * 60*60*24
+		))"
+
+	# If no target file then add Notice
+	if [ -z "$target" ]; then
+		# Select correct Notice
+		case "$report" in
+		expire)
+			notice "\
+* Showing certificates which expire in less than \
+$EASYRSA_PRE_EXPIRY_WINDOW days (--days):"
+		;;
+		revoke)
+			notice "\
+* Showing certificates which are revoked:"
+		;;
+		renew)
+			notice "\
+* Showing certificates which have been renewed but NOT revoked:
+
+*** Marks those which require 'rewind-renew' \
+before they can be revoked."
+		;;
+		*) warn "Unrecognised report: $report"
+		esac
+	fi
+
+	# Create report
+	read_db
+} # => status()
+
+# renew backend
+renew() {
+	# pull filename base:
+	[ "$1" ] || user_error "\
+Error: didn't find a file base name as the first argument.
+Run easyrsa without commands for usage and command help."
+
+	# Assign file_name_base and dust off!
+	file_name_base="$1"
+	shift
+
+	# Assign input files
+	in_dir="$EASYRSA_PKI"
+	crt_in="$in_dir/issued/${file_name_base}.crt"
+	key_in="$in_dir/private/${file_name_base}.key"
+	req_in="$in_dir/reqs/${file_name_base}.req"
+	inline_pub="$in_dir/inline/${file_name_base}.inline"
+	inline_pri="$in_dir/inline/private/${file_name_base}.inline"
+
+	# deprecate ALL options
+	while [ "$1" ]; do
+		case "$1" in
+			nopass)
+				warn "\
+Option 'nopass' is not supported by command 'renew'."
+			;;
+			*) user_error "Unknown option: $1"
+		esac
+		shift
+	done
+
+	# Verify certificate
+	if [ -f "$crt_in" ]; then
+		verify_file x509 "$crt_in" || user_error "\
+Input file is not a valid certificate:
+* $crt_in"
+	else
+		user_error "\
+Missing certificate file:
+* $crt_in"
+	fi
+
+	# Forbid self-signed cert from being expired/renewed/revoked
+	if forbid_selfsign "$crt_in"; then
+		user_error "Cannot $cmd a self-signed certificate."
+	fi
+
+	# Verify request
+	if [ -f "$req_in" ]; then
+		verify_file req "$req_in" || user_error "\
+Input file is not a valid request:
+* $req_in"
+	else
+		user_error "\
+Missing request file:
+* $req_in"
+	fi
+
+	# Get cert commonName
+	cert_CN="$(
+			display_dn x509 "$crt_in" | grep 'commonName'
+		)" || die "renew - display_dn of cert failed"
+
+	# Get req commonName
+	req_CN="$(
+			display_dn req "$req_in" | grep 'commonName'
+		)" || die "renew - display_dn of req failed"
+
+	# For renew, cert_CN must match req_CN
+	[ "$cert_CN" = "$req_CN" ] || user_error \
+		"Certificate cannot be renewed due to commonName mismatch"
+	verbose "cert_CN MATCH req_CN"
+
+	# get the serial number of the certificate
+	ssl_cert_serial "$crt_in" cert_serial || \
+		die "$cmd: Failed to get cert serial number!"
+
+	# Set out_dir
+	out_dir="$EASYRSA_PKI/renewed"
+	crt_out="$out_dir/issued/${file_name_base}.crt"
+
+	# NEVER over-write a renewed cert, revoke it first
+	if [ -f "$crt_out" ]; then
+		user_error "\
+Cannot renew this certificate, a conflicting file exists:
+* certificate: $crt_out
+
+Use command 'revoke-renewed' to revoke this certificate."
+	fi
+
+	# Extract certificate usage from old cert
+	cert_type=
+	ssl_cert_x509v3_eku "$crt_in" cert_type
+
+	# Extract Signature digest from old cert
+	sig_digest=
+	ssl_cert_digest "$crt_in" sig_digest
+	export EASYRSA_DIGEST="$sig_digest"
+
+	# create temp-file for full cert text
+	full_crt_tmp=
+	easyrsa_mktemp full_crt_tmp
+
+	# write full cert text tempfile data
+	"$EASYRSA_OPENSSL" x509 -in "$crt_in" \
+		-noout -text > "$full_crt_tmp" || \
+			die "write full cert text"
+
+	# Use SAN from old cert ONLY
+	if grep -q 'X509v3 Subject Alternative Name' \
+		"$full_crt_tmp"
+	then
+		EASYRSA_SAN="$(
+			grep -A 1 'X509v3 Subject Alternative Name' \
+				"$full_crt_tmp" | \
+					sed -e s/'^\ *'// \
+						-e /'X509v3 Subject Alternative Name'/d \
+						-e s/'IP Address:'/'IP:'/g
+		)" || die "renew - EASYRSA_SAN: easyrsa_openssl subshell"
+		verbose "EASYRSA_SAN: ${EASYRSA_SAN}"
+
+		# --san-crit
+		unset -v EASYRSA_SAN_CRIT
+		if grep -q 'X509v3 Subject Alternative Name: critical' \
+			"$full_crt_tmp"
+		then
+			export EASYRSA_SAN_CRIT='critical,'
+			verbose "--san-crit ENABLED"
+		fi
+
+		export EASYRSA_EXTRA_EXTS="\
+$EASYRSA_EXTRA_EXTS
+subjectAltName = ${EASYRSA_SAN_CRIT}${EASYRSA_SAN}"
+		verbose "EASYRSA_EXTRA_EXTS: ${EASYRSA_EXTRA_EXTS}"
+	fi
+
+	# --bc-crit
+	if grep -q 'X509v3 Basic Constraints: critical' \
+		"$full_crt_tmp"
+	then
+		export EASYRSA_BC_CRIT=1
+		verbose "--bc-crit ENABLED"
+	fi
+
+	# --ku-crit
+	if grep -q 'X509v3 Key Usage: critical' \
+		"$full_crt_tmp"
+	then
+		export EASYRSA_KU_CRIT=1
+		verbose "--ku-crit ENABLED"
+	fi
+
+	# --eku-crit
+	if grep -q 'X509v3 Extended Key Usage: critical' \
+		"$full_crt_tmp"
+	then
+		export EASYRSA_EKU_CRIT=1
+		verbose "--eku-crit ENABLED"
+	fi
+
+	# Disable options not supported by renew
+	unset -v EASYRSA_AUTO_SAN EASYRSA_NEW_SUBJECT
+
+	# confirm operation by displaying Warning
+	confirm "Continue with 'renew' ? " yes "\
+WARNING: This process is destructive!
+
+These files will be MOVED to the 'renewed' sub-directory:
+* $crt_in
+
+These files will be DELETED:
+All PKCS files for commonName: $file_name_base
+
+The inline credentials files:
+* $inline_pub
+* $inline_pri
+
+The CA attibutes file will be set to 'unique_subject = no'.
+Required to create a new certificate with an existing name."
+
+	# Set 'unique_subject = no' in index.txt.attr
+	CA_attrib='unique_subject = no'
+	print "$CA_attrib" > "$EASYRSA_PKI"/index.txt.attr || \
+		die "Failed to update index.txt.attr"
+
+	# move renewed files
+	# so we can reissue certificate with the same name
+	renew_move
+	error_undo_renew_move=1
+
+	# Set to modify sign-req confirmation message
+	local_request=1
+
+	# renew certificate
+	# EASYRSA_BATCH=1
+	fn_name="$fn_name; sign_req"
+	if sign_req "$cert_type" "$file_name_base"
+	then
+		fn_name="${fn_name%; sign_req}"
+		unset -v error_undo_renew_move
+	else
+		# If renew failed then restore cert.
+		# Otherwise, issue a warning
+		renew_restore_move
+		die "Renewal has failed to build a new certificate."
+	fi
+
+	# Success messages
+	notice "\
+Renew was successful.
+
+                    * IMPORTANT *
+
+Renew has created a new certificate, to replace the old one.
+
+To revoke the old certificate, once the new one has been deployed,
+use command 'revoke-renewed $file_name_base'"
+} # => renew()
+
+# Restore files on failure to renew
+renew_restore_move() {
+	# restore crt file to PKI folders
+	rrm_err=
+	if mv "$restore_crt_out" "$restore_crt_in"; then
+		: # ok
+	else
+		warn "Failed to restore: $restore_crt_in"
+		rrm_err=1
+	fi
+
+	# messages
+	if [ "$rrm_err" ]; then
+		warn "Failed to restore renewed files."
+	else
+		notice "\
+Renew FAILED but files have been successfully restored."
+	fi
+} # => renew_restore_move()
+
+# renew_move
+# moves renewed certificates to the 'renewed' folder
+# allows reissuing certificates with the same name
+renew_move() {
+	# make sure renewed dirs exist
+	mkdir -p "$out_dir"/issued || \
+		die "renew_move() - Failed to create '$out_dir/issued' directory."
+
+	# move crt to renewed folders
+	# After this point, renew is possible!
+	restore_crt_in="$crt_in"
+	restore_crt_out="$crt_out"
+	mv "$crt_in" "$crt_out" || \
+		die "Failed to move: $crt_in"
+
+	# Remove files that can be recreated:
+	# remove any pkcs files
+	for pkcs in p12 p7b p8 p1; do
+		# issued
+		rm -f "$in_dir/issued/$file_name_base.$pkcs"
+		# private
+		rm -f "$in_dir/private/$file_name_base.$pkcs"
+	done
+
+	# remove inline files
+	rm -f "$inline_pub" "$inline_pri" || warn \
+		"renew_move - Error trying to remove inline files."
+} # => renew_move()
+
+# Verify certificate against CA
+verify_cert() {
+	# pull filename base:
+	[ "$1" ] || user_error "\
+Error: didn't find a <file-name-base> as the first argument.
+Run easyrsa without commands for usage and command help."
+
+	# Assign file_name_base and dust off!
+	file_name_base="$1"
+	shift
+
+	# function opts support
+	while [ "$1" ]; do
+		case "$1" in
+			# batch flag, return status [0/1] to calling
+			# program.  Otherwise, exit 0 on completion.
+			batch) EASYRSA_BATCH=1 ;;
+			*) warn "Ignoring unknown command option: '$1'"
+		esac
+		shift
+	done
+
+	in_dir="$EASYRSA_PKI"
+	ca_crt="$in_dir/ca.crt"
+	crt_in="$in_dir/issued/$file_name_base.crt"
+
+	# Cert file must exist
+	[ -f "$crt_in" ] || user_error "\
+No certificate found for the input:
+* '$crt_in'"
+
+	# Verify file is a valid cert
+	verify_file x509 "$crt_in" || user_error "\
+Input is not a valid certificate:
+* $crt_in"
+
+	# Silent SSL or not
+	if [ "$EASYRSA_SILENT_SSL" ]; then
+		# Test SSL out
+		# openssl direct call because error is expected
+		if "$EASYRSA_OPENSSL" verify \
+			-CAfile "$ca_crt" "$crt_in" >/dev/null
+		then
+			verify_cert_ok=1
+		else
+			unset -v verify_cert_ok
+		fi
+	else
+		if "$EASYRSA_OPENSSL" verify \
+			-CAfile "$ca_crt" "$crt_in"
+		then
+			verify_cert_ok=1
+		else
+			unset -v verify_cert_ok
+		fi
+	fi
+
+	# Return cert status
+	if [ "$verify_cert_ok" ]; then
+		notice "\
+  Certificate name:    $file_name_base
+  Verification status: GOOD"
+	else
+		notice "\
+  Certificate name:    $file_name_base
+  Verification status: FAILED"
+
+		# Exit with error (batch mode)
+		if [ "$EASYRSA_BATCH" ]; then
+			# exit with error at cleanup
+			easyrsa_exit_with_error=1
+			# Return error for internal callers
+			return 1
+		fi
+	fi
+} # => verify_cert()
+
+# Renew CA certificate
+renew_ca_cert() {
+	# dirs and files
+	ca_key_file="$EASYRSA_PKI"/private/ca.key
+	ca_cert_file="$EASYRSA_PKI"/ca.crt
+	exp_ca_cert_list="$EASYRSA_PKI"/expired-ca.list
+
+	# Set fixed variables
+	x509=1
+	date_stamp=1
+	f_name="renew_ca_cert()"
+
+	# Set default CA commonName
+	[ "$EASYRSA_REQ_CN" = ChangeMe ] || \
+		warn "\
+$cmd does not support setting an external commonName."
+
+	# Copy Old CA commonName as default
+	EASYRSA_REQ_CN="$(
+		"$EASYRSA_OPENSSL" x509 -in "$ca_cert_file" \
+		-noout -subject -nameopt utf8,multiline | \
+			grep 'commonName' | sed -e \
+			s\`^[[:blank:]]*commonName[[:blank:]]*=[[:blank:]]\`\`
+	)" || die "renew_ca_cert - Failed to get EASYRSA_REQ_CN"
+	export EASYRSA_REQ_CN
+
+	# Extract Signature digest from old cert
+	sig_digest=
+	ssl_cert_digest "$ca_cert_file" sig_digest
+	export EASYRSA_DIGEST="$sig_digest"
+
+	# Set ssl batch mode, as required
+	[ "$EASYRSA_BATCH" ] && ssl_batch=1
+
+	# Assign new cert temp-file
+	out_cert_tmp=
+	easyrsa_mktemp out_cert_tmp
+
+	# Assign old cert temp-file
+	old_cert_tmp=
+	easyrsa_mktemp old_cert_tmp
+
+	# Write complete CA cert to old cert temp-file
+	"$EASYRSA_OPENSSL" x509 -in "$ca_cert_file" \
+		-text > "$old_cert_tmp" || \
+			die "$f_name Write CA cert to temp-file"
+
+	# Find or create x509 CA file
+	# Note: $new_x509_type_file_tmp is non-local
+	# set by select_x509_type_tmp()
+	select_x509_type_tmp ca
+	x509_type_tmp_file_ca="$new_x509_type_file_tmp"
+	verbose "x509_type_tmp_file_ca = '$x509_type_tmp_file_ca'"
+
+	# basicConstraints critical
+	if grep -q 'Basic Constraints: critical' "$old_cert_tmp"
+	then
+		add_critical_attrib basicConstraints \
+			"$x509_type_tmp_file_ca" x509_type_tmp_file_ca || \
+				die "add_critical_attrib bC"
+		verbose "basicConstraints critical OK"
+	fi
+
+	# keyUsage critical
+	if grep -q 'Key Usage: critical' "$old_cert_tmp"
+	then
+		add_critical_attrib keyUsage \
+			"$x509_type_tmp_file_ca" x509_type_tmp_file_ca || \
+				die "add_critical_attrib kU"
+		verbose "keyUsage critical OK"
+	fi
+
+	# Find or create x509 COMMON file
+	select_x509_type_tmp COMMON
+	x509_type_tmp_file_COMMON="$new_x509_type_file_tmp"
+	verbose "x509_type_tmp_file_COMMON = '$x509_type_tmp_file_COMMON'"
+
+	# Check for insert-marker in ssl config file
+	if ! grep -q '^#%CA_X509_TYPES_EXTRA_EXTS%' \
+		"$EASYRSA_SSL_CONF"
+	then
+		die "\
+This openssl config file does not support X509-type 'ca'.
+* $EASYRSA_SSL_CONF
+
+Please update 'openssl-easyrsa.cnf' to the latest Easy-RSA release."
+	fi
+
+	# Assign awkscript to insert EASYRSA_EXTRA_EXTS
+	# shellcheck disable=SC2016 # No expand '' - build_ca()
+	awkscript='\
+{if ( match($0, "^#%CA_X509_TYPES_EXTRA_EXTS%") )
+{ while ( getline<"/dev/stdin" ) {print} next }
+{print} }'
+
+	# Assign tmp-file for config
+	adjusted_ssl_cnf_tmp=""
+	easyrsa_mktemp adjusted_ssl_cnf_tmp
+
+	# Insert x509-types COMMON and 'ca' and EASYRSA_EXTRA_EXTS
+	{
+		# X509 files
+		cat "$x509_type_tmp_file_ca" "$x509_type_tmp_file_COMMON"
+
+		# User extensions
+		[ "$EASYRSA_EXTRA_EXTS" ] && \
+			print "$EASYRSA_EXTRA_EXTS"
+
+	} | awk "$awkscript" "$EASYRSA_SSL_CONF" \
+			> "$adjusted_ssl_cnf_tmp" || \
+				die "$f_name Copy X509_TYPES to config failed"
+	verbose "Insert x509 and extensions OK"
+
+	# Use this new SSL config for the rest of this function
+	export EASYRSA_SSL_CONF="$adjusted_ssl_cnf_tmp"
+
+	# Generate new CA cert:
+	easyrsa_openssl req -utf8 -new \
+		-key "$ca_key_file" \
+		-out "$out_cert_tmp" \
+		${ssl_batch:+ -batch} \
+		${x509:+ -x509} \
+		${date_stamp:+ -days "$EASYRSA_CA_EXPIRE"} \
+		${EASYRSA_DIGEST:+ -"$EASYRSA_DIGEST"} \
+		${EASYRSA_NO_PASS:+ "$no_password"} \
+		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} \
+		# EOL
+
+	# Collect New CA text
+	new_ca_text="$(
+		"$EASYRSA_OPENSSL" x509 -in "$out_cert_tmp" -noout -text
+	)"
+
+	# Confirm renewed certificate installation
+	confirm "Install the new CA certificate ? " yes "
+NEW CA CERTIFICATE:
+
+$new_ca_text
+
+WARNING !!!
+
+Your CA certificate is ready to be renewed. (Details above)
+
+This new CA certificate will completely replace the old one.
+The old CA will be archived to the 'expired-ca.list' file.
+
+Please check the details above are correct, before continuing."
+
+	# Prepare header file for updated old CA list
+	header_tmp=
+	easyrsa_mktemp header_tmp
+
+	# header and separator text
+	hdr='# Easy-RSA expired CA certificate list:'
+	spr='# ====================================='
+
+	# make full header temp-file
+	printf '%s\n%s\n\n' "$hdr" "$spr" > "$header_tmp" || \
+		die "$f_name printf header to header-temp"
+
+	# Prepare old cert list
+	if [ -f "$exp_ca_cert_list" ]; then
+		# Assign old cert list temp file
+		exp_cert_list_tmp=
+		easyrsa_mktemp exp_cert_list_tmp
+
+		# write list to temp-fie, remove header not separators
+		sed -e s/"^${hdr}$"// \
+			"$exp_ca_cert_list" > "$exp_cert_list_tmp" || \
+				die "$f_name sed exp_ca_cert_list"
+	fi
+
+	# Add full old CA Cert to old CA Cert list file
+	if [ -f "$exp_cert_list_tmp" ]; then
+		cat "$header_tmp" "$old_cert_tmp" "$exp_cert_list_tmp" \
+			> "$exp_ca_cert_list" || \
+				die "$f_name cat exp_cert_list_tmp"
+	else
+		cat "$header_tmp" "$old_cert_tmp" \
+			> "$exp_ca_cert_list" || \
+				die "$f_name cat old_cert_tmp"
+	fi
+
+	# Install renewed CA Cert temp-file as current CA cert
+	mv -f "$out_cert_tmp" "$ca_cert_file" || \
+		die "Failed to install renewed CA temp-file!"
+
+	notice "\
+CA certificate has been successfully renewed.
+
+Your old CA certificate has been added to the expired CA list at:
+* $exp_ca_cert_list
+
+Your renewed CA certificate is at:
+* $ca_cert_file"
+} # => renew_ca_cert()
+
+# update-db backend
+update_db() {
+	easyrsa_openssl ca -utf8 -updatedb \
+		${EASYRSA_PASSIN:+ -passin "$EASYRSA_PASSIN"} || \
+			die "Failed to perform update-db."
+} # => update_db()
+
+# display cert DN info on a req/X509, passed by full pathname
+display_dn() {
+	[ "$#" = 2 ] || die "\
+display_dn - input error"
+
+	format="$1"
+	path="$2"
+	shift 2
+
+	# Display DN
+	"$EASYRSA_OPENSSL" "$format" -in "$path" -noout -subject \
+		-nameopt utf8,sep_multiline,space_eq,lname,align
+} # => display_dn()
+
+# verify a file seems to be a valid req/X509
+verify_file() {
+	format="$1"
+	path="$2"
+	"$EASYRSA_OPENSSL" "$format" -in "$path" -noout 2>/dev/null
+} # => verify_file()
+
+# show-* command backend
+# Prints req/cert details in a readable format
+show() {
+	type="$1"
+	name="$2"
+	in_file=""
+	format=""
+	[ "$name" ] || user_error "\
+Missing expected <file_name_base> argument.
+Run easyrsa without commands for usage help."
+	shift 2
+
+	# opts support
+	type_opts="-${type}opt"
+	out_opts="no_pubkey,no_sigdump"
+	name_opts="utf8,sep_multiline,space_eq,lname,align"
+	while [ "$1" ]; do
+		case "$1" in
+			full) out_opts= ;;
+			*) warn "Ignoring unknown command option: '$1'"
+		esac
+		shift
+	done
+
+	# Determine cert/req type (v2)
+	case "$type" in
+	cert)
+		in_file="$EASYRSA_PKI/issued/$name.crt"
+		format="x509"
+		;;
+	req)
+		in_file="$EASYRSA_PKI/reqs/$name.req"
+		format="req"
+		;;
+	crl)
+		in_file="$EASYRSA_PKI/$name.pem"
+		format="crl"
+		unset -v type_opts out_opts name_opts
+		;;
+	*) die "Unrecognised type: $type"
+	esac
+
+	# Verify file exists and is of the correct type
+	[ -f "$in_file" ] || user_error "\
+No such '$type' type file with a <file_name_base> of '$name'.
+Expected to find this file at:
+* $in_file"
+
+	verify_file "$format" "$in_file" || user_error "\
+This file is not a valid $type file:
+* $in_file"
+
+	notice "\
+Showing '$type' details for: '$name'
+
+This file is stored at:
+* $in_file${NL}"
+
+	easyrsa_openssl "$format" -in "$in_file" -noout -text \
+		${type_opts:+ "$type_opts" "$out_opts"} \
+		${name_opts:+ -nameopt "$name_opts"} || \
+			die "OpenSSL failure to process the input"
+} # => show()
+
+# show-ca command backend
+# Prints CA cert details in a readable format
+show_ca() {
+	# opts support
+	cert_opts="no_pubkey,no_sigdump"
+	name_opts="utf8,sep_multiline,space_eq,lname,align"
+	while [ "$1" ]; do
+		case "$1" in
+			full) cert_opts= ;;
+			*) warn "Ignoring unknown command option: '$1'"
+		esac
+		shift
+	done
+
+	in_file="$EASYRSA_PKI/ca.crt"
+	format="x509"
+
+	# Verify file exists and is of the correct type
+	[ -f "$in_file" ] || user_error "\
+No such $type file with a basename of '$name' is present.
+Expected to find this file at:
+* $in_file"
+
+	verify_file "$format" "$in_file" || user_error "\
+This file is not a valid $type file:
+* $in_file"
+
+	notice "\
+Showing details for CA certificate, at:
+* $in_file${NL}"
+
+	easyrsa_openssl "$format" -in "$in_file" -noout \
+		-text -nameopt "$name_opts" -certopt "$cert_opts" || \
+			die "OpenSSL failure to process the input"
+} # => show_ca()
+
+# Certificate X509v3 Extended Key Usage
+# ''$ceku_*'' is Cert EKU, to localize function variables
+ssl_cert_x509v3_eku() {
+	# check input file name
+	if [ -f "$1" ]; then
+		ceku_crt="$1"
+	else
+		ceku_crt="${EASYRSA_PKI}/issued/${1}.crt"
+		[ -f "$ceku_crt" ] || \
+			die "ssl_cert_x509v3_eku - Missing cert '$ceku_crt'"
+	fi
+
+	# required variables
+	ceku_pattern='X509v3 Extended Key Usage:'
+	ceku_cli='TLS Web Client Authentication'
+	ceku_srv='TLS Web Server Authentication'
+	ceku_srv_cli="${ceku_srv}, ${ceku_cli}"
+	ceku_codeSign='Code Signing'
+	ceku_known=
+
+	# Extract certificate Extended Key Usage
+	if [ "$ssl_lib_name" = libressl ]; then
+		ceku_eku="$(
+			"$EASYRSA_OPENSSL" x509 -in "$ceku_crt" -noout \
+				-text | \
+					sed -n "/${ceku_pattern}/{n;s/^ *//g;p;}"
+			)" || die "ssl_cert_x509v3_eku - LibreSSL error"
+	else
+		ceku_eku="$(
+			"$EASYRSA_OPENSSL" x509 -in "$ceku_crt" -noout \
+				-ext extendedKeyUsage | \
+					sed -e /"${ceku_pattern}"/d -e s/^\ *//
+			)" || die "ssl_cert_x509v3_eku - OpenSSL error"
+	fi
+
+	# Match EKU with supported usage
+	case "$ceku_eku" in
+		"$ceku_srv_cli")
+			ceku_known=1
+			ceku_type=serverClient
+			;;
+		"$ceku_cli")
+			ceku_known=1
+			ceku_type=client
+			;;
+		"$ceku_srv")
+			ceku_known=1
+			ceku_type=server
+			;;
+		"$ceku_codeSign")
+			ceku_known=1
+			# translate 'Code Signing' into x509-type file-name
+			ceku_type=codeSigning
+			;;
+		'')
+			ceku_type=undefined
+			;;
+		*)
+			ceku_type="'$ceku_eku'"
+	esac
+
+	# Check for self-sign
+	if "$EASYRSA_OPENSSL" x509 -in "$ceku_crt" \
+		-noout -text | grep -q 'CA:TRUE'
+	then
+		ceku_type="self-signed-$ceku_type"
+	fi
+
+	# Set variable to return
+	if [ "$2" ]; then
+		force_set_var "$2" "$ceku_type" || \
+			die "ssl_cert_x509v3_eku - force_set_var failed"
+		verbose "ssl_cert_x509v3_eku; EKU='$ceku_type' [$2]"
+	elif [ "$ceku_known" ]; then
+		information "\
+* Known X509v3 Extended Key Usage: '$ceku_type'"
+	else
+		information "\
+* UNKNOWN X509v3 Extended Key Usage: '$ceku_type'"
+	fi
+
+	# Succeed for known types only
+	[ "$ceku_known" ] && return
+	return 1
+} # => ssl_cert_x509v3_eku()
+
+# get the digest of the certificate
+ssl_cert_digest() {
+	[ "$#" = 2 ] || die "ssl_cert_digest - input error"
+	[ -f "$1" ] || die "ssl_cert_digest - missing cert"
+
+	fn_ssl_out="$(
+		"$EASYRSA_OPENSSL" x509 -in "$1" -noout -text \
+			-certopt no_header,no_version,no_serial,no_sigdump \
+			-certopt no_pubkey,no_validity,no_subject,no_issuer \
+			-certopt no_extensions
+		)" || die "ssl_cert_digest - failed: digest"
+
+	# remove the 'Signature Algorithm: ' part
+	fn_ssl_out="${fn_ssl_out##*: }"
+
+	case "$fn_ssl_out" in
+		# remove the 'WithRSAEncryption' part
+		*WithRSAEncryption)
+			fn_ssl_out="${fn_ssl_out%%With*}"
+			"$EASYRSA_OPENSSL" dgst "-$fn_ssl_out" "$1" || \
+				die "ssl_cert_digest - RSA Bad digest: '$fn_ssl_out'"
+		;;
+		# remove the 'ecdsa-with-' part
+		ecdsa-with-*)
+			fn_ssl_out="${fn_ssl_out##*with-}"
+			"$EASYRSA_OPENSSL" dgst "-$fn_ssl_out" "$1" || \
+				die "ssl_cert_digest - EC Bad digest: '$fn_ssl_out'"
+		;;
+		# remove everything for Edwards Curve
+		E[dD]25519|E[dD]448)
+			fn_ssl_out=""
+			# digest verification is not required
+		;;
+		*) die "ssl_cert_digest - Unknown Sig-Alg: '$fn_ssl_out'"
+	esac
+
+	force_set_var "$2" "$fn_ssl_out" || \
+		die "ssl_cert_digest - failed to set var '$*'"
+
+	unset -v fn_ssl_out
+} # => ssl_cert_digest()
+
+# get the serial number of the certificate -> serial=XXXX
+ssl_cert_serial() {
+	[ "$#" = 2 ] || die "ssl_cert_serial - input error"
+	[ -f "$1" ] || die "ssl_cert_serial - missing cert"
+
+	fn_ssl_out="$(
+		"$EASYRSA_OPENSSL" x509 -in "$1" -noout -serial
+		)" || die "ssl_cert_serial - failed: -serial"
+	# remove the serial= part -> we only need the XXXX part
+	fn_ssl_out="${fn_ssl_out##*=}"
+
+	force_set_var "$2" "$fn_ssl_out" || \
+		die "ssl_cert_serial - failed to set var '$*'"
+
+	unset -v fn_ssl_out
+} # => ssl_cert_serial()
+
+# Identify host OS
+detect_host() {
+	unset -v \
+		easyrsa_ver_test easyrsa_host_os easyrsa_host_test \
+			easyrsa_win_git_bash
+
+	# Detect Windows
+	[ "${OS}" ] && easyrsa_host_test="${OS}"
+
+	# shellcheck disable=SC2016 # No expand '' - detect_host()
+	easyrsa_ksh=\
+'@(#)MIRBSD KSH R39-w32-beta14 $Date: 2013/06/28 21:28:57 $'
+
+	[ "${KSH_VERSION}" = "${easyrsa_ksh}" ] && \
+		easyrsa_host_test="${easyrsa_ksh}"
+	unset -v easyrsa_ksh
+
+	# If not Windows then nix
+	if [ "${easyrsa_host_test}" ]; then
+		easyrsa_host_os=win
+		easyrsa_uname="${easyrsa_host_test}"
+		easyrsa_shell="$SHELL"
+		# Detect Windows git/bash
+		if [ "${EXEPATH}" ]; then
+			easyrsa_shell="$SHELL (Git)"
+			easyrsa_win_git_bash="${EXEPATH}"
+			# If found then set openssl NOW!
+			#[ -e /usr/bin/openssl ] && \
+			#	set_var EASYRSA_OPENSSL /usr/bin/openssl
+		fi
+	else
+		easyrsa_host_os=nix
+		easyrsa_uname="$(uname 2>/dev/null)"
+		easyrsa_shell="${SHELL:-undefined}"
+	fi
+
+	easyrsa_ver_test="${EASYRSA_version%%~*}"
+	if [ "$easyrsa_ver_test" ]; then
+		host_out="Host: $EASYRSA_version"
+	else
+		host_out="Host: dev"
+	fi
+
+	host_out="\
+$host_out | $easyrsa_host_os | $easyrsa_uname | $easyrsa_shell"
+	host_out="\
+${host_out}${easyrsa_win_git_bash+ | "$easyrsa_win_git_bash"}"
+	unset -v easyrsa_ver_test easyrsa_host_test
+} # => detect_host()
+
+# Extra diagnostics
+show_host() {
+	[ "$EASYRSA_SILENT" ] && return
+	print_version
+	print "$host_out"
+	[ "$EASYRSA_DEBUG" ] || return 0
+	case "$easyrsa_host_os" in
+		win) set ;;
+		nix) env ;;
+		*) print "Unknown host OS: $easyrsa_host_os"
+	esac
+} # => show_host()
+
+# Verify the selected algorithm parameters
+verify_algo_params() {
+	case "$EASYRSA_ALGO" in
+	rsa)
+		[ "$EASYRSA_CURVE" ] && user_error "\
+Elliptic curve cryptography cannot be use with algo '$EASYRSA_ALGO'"
+		# Set RSA key size
+		EASYRSA_ALGO_PARAMS="$EASYRSA_KEY_SIZE"
+		;;
+	ec)
+		if [ -f "$EASYRSA_ALGO_PARAMS" ]; then
+			# User supplied file
+			verbose "External ecparams file '$EASYRSA_ALGO_PARAMS'"
+		elif [ -d "$EASYRSA_TEMP_DIR" ]; then
+			# generate file
+			unset -v EASYRSA_ALGO_PARAMS
+			easyrsa_mktemp EASYRSA_ALGO_PARAMS
+			"$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" \
+				-out "$EASYRSA_ALGO_PARAMS" >/dev/null 2>&1 || user_error \
+					"Failed to generate ecparams for curve '$EASYRSA_CURVE'"
+		else
+			# Verify only
+			"$EASYRSA_OPENSSL" ecparam -name "$EASYRSA_CURVE" \
+				>/dev/null 2>&1 || user_error \
+					"Failed to verify ecparams for curve '$EASYRSA_CURVE'"
+		fi
+		;;
+	ed)
+		# Verify Edwards curve
+		"$EASYRSA_OPENSSL" genpkey -algorithm "$EASYRSA_CURVE" \
+			>/dev/null 2>&1 || user_error \
+				"Edwards Curve '$EASYRSA_CURVE' not found."
+		;;
+	*) user_error "\
+Unknown algorithm '$EASYRSA_ALGO': Must be 'rsa', 'ec' or 'ed'"
+	esac
+	verbose "\
+verify_algo_params; OK: Algo '$EASYRSA_ALGO' - Curve '${EASYRSA_CURVE:-None}'"
+} # => verify_algo_params()
+
+# Check for conflicting input options
+mutual_exclusions() {
+	# --nopass cannot be used with --passout
+	if [ "$EASYRSA_PASSOUT" ]; then
+		# --passout MUST take priority over --nopass
+		[ "$EASYRSA_NO_PASS" ] && warn "\
+Option --passout cannot be used with --nopass|nopass."
+		unset -v EASYRSA_NO_PASS
+		prohibit_no_pass=1
+	fi
+
+	# Restrict --days=0 to 'show-expire'
+	if [ "$EASYRSA_ALIAS_DAYS" = 0 ]; then
+		case "$cmd" in
+			show-expire) : ;; # ok
+			*) user_error "Cannot use --days=0 for command $cmd"
+		esac
+	fi
+
+	# --silent-ssl requires --batch
+	if [ "$EASYRSA_SILENT_SSL" ]; then
+		[ "$EASYRSA_BATCH" ] || warn "\
+Option --silent-ssl requires batch mode --batch."
+	fi
+
+	# --startdate requires --enddate
+	# otherwise, --days counts from now
+	if [ "$EASYRSA_START_DATE" ]; then
+		[ "$EASYRSA_END_DATE" ] || user_error "\
+Use of --startdate requires use of --enddate."
+	fi
+
+	# Basic --startdate/--enddate check
+	case "${#EASYRSA_START_DATE}" in
+		0|13|15) : ;; # ok
+		*) user_error "\
+Format of --startdate/--enddate must be [YY]YYMMDDhhmmssZ"
+	esac
+
+	case "${#EASYRSA_END_DATE}" in
+		0|13|15) : ;; # ok
+		*) user_error "\
+Format of --startdate/--enddate must be [YY]YYMMDDhhmmssZ"
+	esac
+
+	# --enddate may over-rule EASYRSA_CERT_EXPIRE
+	if [ "$EASYRSA_END_DATE" ]; then
+		case "$cmd" in
+			sign-req|build-*-full|renew)
+				# User specified EASYRSA_ALIAS_DAYS IS over-ruled
+				if [ "$EASYRSA_ALIAS_DAYS" ]; then
+					warn "\
+Option --days is over-ruled by option --enddate."
+				fi
+				unset -v EASYRSA_CERT_EXPIRE EASYRSA_ALIAS_DAYS
+				;;
+			*)
+				warn "\
+EasyRSA '$cmd' does not support --startdate or --enddate"
+				unset -v EASYRSA_START_DATE EASYRSA_END_DATE
+		esac
+	fi
+
+	# Insecure Windows directory
+	if [ "$easyrsa_host_os" = win ]; then
+		if echo "$PWD" | grep -q '/Prog.*/OpenVPN/easy-rsa'
+		then
+			verbose "\
+Using Windows-System-Folders for your PKI is NOT SECURE!
+Your Easy-RSA PKI CA Private Key is WORLD readable.
+
+To correct this problem, it is recommended that you either:
+* Copy Easy-RSA to your User folders and run it from there, OR
+* Define your PKI to be in your User folders. EG:
+  'easyrsa --pki-dir=\"C:/Users/<your-user-name>/easy-rsa/pki\"\
+ <command>'"
+		fi
+	fi
+
+	verbose "mutual_exclusions; COMPLETED"
+} # => mutual_exclusions()
+
+# Select vars in order preference:
+# Here sourcing of 'vars' if present occurs.
+# If not present, defaults are used to support
+# running without a sourced config format.
+select_vars() {
+	# Deliberately ignore vars
+	[ "$EASYRSA_NO_VARS" ] && return 1
+
+	# User specified vars file will be used ONLY
+	if [ "$EASYRSA_VARS_FILE" ]; then
+		: # Takes priority, nothing to do
+
+	# This is where auto-load goes bananas
+	else
+
+		# User specified PKI; if vars exists, use it ONLY
+		if [ "$EASYRSA_PKI" ]; then
+			if [ -f "$EASYRSA_PKI"/vars ]; then
+				set_var EASYRSA_VARS_FILE "$EASYRSA_PKI"/vars
+			fi
+		fi
+
+		# User specified EASYRSA; if vars exists, use it ONLY
+		if [ "$EASYRSA" ]; then
+			if [ -f "$EASYRSA"/vars ]; then
+				set_var EASYRSA_VARS_FILE "$EASYRSA"/vars
+			fi
+		fi
+
+		# Default PKI; if vars exists, use it ONLY
+		if [ -f "$PWD"/pki/vars ] && \
+			[ -z "$EASYRSA_PKI" ] && [ -z "$EASYRSA" ]
+		then
+			# Prevent vars from changing 'expected' PKI.
+			# A vars in the PKI MUST always imply EASYRSA_PKI
+			expected_EASYRSA="$PWD"
+			expected_EASYRSA_PKI="$PWD"/pki
+			set_var EASYRSA_VARS_FILE "$PWD"/pki/vars
+		fi
+
+		# Default working dir; if vars exists, use it ONLY
+		if [ -f "$PWD"/vars ]; then
+			set_var EASYRSA_VARS_FILE "$PWD"/vars
+		fi
+	fi
+
+	# if select_vars failed to find a vars file
+	if [ -z "$EASYRSA_VARS_FILE" ]; then
+		verbose "select_vars; No vars"
+		return 1
+	fi
+	verbose "select_vars; selected $EASYRSA_VARS_FILE"
+} # => select_vars()
+
+# Source a vars file
+source_vars() {
+	# File to be sourced
+	target_file="$1"
+
+	# target_file MUST exist
+	[ -f "$target_file" ] || user_error "\
+Missing vars file:
+* $target_file"
+
+	# Sanitize target_file
+	if grep -v '^[[:blank:]]*#' "$target_file" | grep -q \
+		-e 'EASYRSA_PASSIN' -e 'EASYRSA_PASSOUT' \
+		-e '`' \
+		-e 'EASYRSA_[_[:upper:]]*=.*' \
+		-e 'export[[:blank:]]' \
+		-e 'unset[[:blank:]]' \
+		# EOL
+	then
+		# here we go ..
+		err_msg="\
+These problems have been found in your 'vars' settings:
+* $target_file"
+
+		# No passwords!
+		if grep -v '^[[:blank:]]*#' "$target_file" | \
+			grep -q -e 'EASYRSA_PASSIN' -e 'EASYRSA_PASSOUT'
+		then
+			err_msg="${err_msg}${NL}
+  Use of 'EASYRSA_PASSIN' or 'EASYRSA_PASSOUT':
+  Storing password information in the 'vars' file is not permitted."
+			# enforce this rule
+			unset -v EASYRSA_FORCE_VARS
+		fi
+
+		# No backticks
+		if grep -v '^[[:blank:]]*#' "$target_file" | \
+			grep -q -e '`'
+		then
+			err_msg="${err_msg}${NL}
+  Use of unsupported characters:
+  These characters are not supported: \` backtick"
+		fi
+
+		# No standard assignment by '='
+		if grep -v '^[[:blank:]]*#' "$target_file" | \
+			grep -q -e 'EASYRSA_[_[:upper:]]*='
+		then
+			err_msg="${err_msg}${NL}
+  Assignment by '=':
+  Remove '=' and replace it with 'set_var'."
+		fi
+
+		# No export
+		if grep -v '^[[:blank:]]*#' "$target_file" | \
+			grep -q -e 'export[[:blank:]]'
+		then
+			err_msg="${err_msg}${NL}
+  Use of 'export':
+  Remove 'export' or replace it with 'set_var'."
+		fi
+
+		# No unset
+		if grep -v '^[[:blank:]]*#' "$target_file" | \
+			grep -q -e 'unset[[:blank:]]'
+		then
+			err_msg="${err_msg}${NL}
+  Use of 'unset':
+  Remove 'unset' ('force_set_var' may also work)."
+		fi
+
+		# Fatal error
+		if [ "$EASYRSA_FORCE_VARS" ]; then
+			warn "${err_msg}"
+			verbose "source_vars; ignore 'vars' errors"
+		else
+			user_error "${err_msg}${NL}
+Please, correct these errors and try again."
+		fi
+	fi
+
+	# Enable sourcing target_file
+	# shellcheck disable=SC2034 # EASYRSA_CALLER appears unused
+	EASYRSA_CALLER=1
+
+	# Test sourcing target_file in a subshell
+	# shellcheck disable=1090 # can't follow - source_vars()
+	if ( set -e; . "$target_file" 2>/dev/null ); then
+		# Source target_file now
+		# shellcheck disable=1090 # can't follow - source_vars()
+		. "$target_file" || \
+			die "Failed to source the '$target_file' file."
+	else
+		die "Failed to dry-run the '$target_file' file."
+	fi
+
+	verbose "source_vars; sourced $target_file"
+	unset -v EASYRSA_CALLER target_file err_msg
+} # => source_vars()
+
+# Set defaults
+default_vars() {
+	# Set defaults, preferring existing env-vars if present
+	set_var EASYRSA					"$PWD"
+	set_var EASYRSA_OPENSSL			openssl
+	set_var EASYRSA_PKI				"$EASYRSA/pki"
+	set_var EASYRSA_DN				cn_only
+	set_var EASYRSA_REQ_COUNTRY		"US"
+	set_var EASYRSA_REQ_PROVINCE	"California"
+	set_var EASYRSA_REQ_CITY		"San Francisco"
+	set_var EASYRSA_REQ_ORG			"Copyleft Certificate Co"
+	set_var EASYRSA_REQ_EMAIL		me@example.net
+	set_var EASYRSA_REQ_OU			"My Organizational Unit"
+	set_var EASYRSA_REQ_SERIAL		""
+	set_var EASYRSA_ALGO			rsa
+	set_var EASYRSA_KEY_SIZE		2048
+
+	case "$EASYRSA_ALGO" in
+		rsa)
+			: # ok
+			# default EASYRSA_KEY_SIZE must always be set
+			# it must NOT be set selectively because it is
+			# present in the SSL config file
+			;;
+		ec)
+			set_var EASYRSA_CURVE		secp384r1
+			;;
+		ed)
+			set_var EASYRSA_CURVE		ed25519
+			;;
+		*) user_error "\
+Algorithm '$EASYRSA_ALGO' is invalid: Must be 'rsa', 'ec' or 'ed'"
+	esac
+
+	set_var EASYRSA_CA_EXPIRE		3650
+	set_var EASYRSA_CERT_EXPIRE		825
+	set_var \
+		EASYRSA_PRE_EXPIRY_WINDOW	90
+	set_var EASYRSA_CRL_DAYS		180
+	set_var EASYRSA_NS_SUPPORT		no
+	set_var EASYRSA_NS_COMMENT		\
+		"Easy-RSA (~VER~) Generated Certificate"
+
+	set_var EASYRSA_TEMP_DIR		"$EASYRSA_PKI"
+	set_var EASYRSA_REQ_CN			ChangeMe
+	set_var EASYRSA_DIGEST			sha256
+
+	set_var EASYRSA_MAX_TEMP		1
+
+	# configure EASYRSA_SAN_CRIT for use
+	export EASYRSA_SAN_CRIT="${EASYRSA_SAN_CRIT:+critical,}"
+
+	verbose "default_vars; COMPLETED"
+} # => default_vars()
+
+# Validate expected values for EASYRSA and EASYRSA_PKI
+validate_default_vars() {
+	unset -v unexpected_error
+
+	# Keep checks separate
+	# EASYRSA
+	if [ "$expected_EASYRSA" ]; then
+		[ "$expected_EASYRSA" = "$EASYRSA" ] || \
+			unexpected_error="\
+       EASYRSA: $EASYRSA
+      Expected: $expected_EASYRSA"
+	fi
+
+	# EASYRSA_PKI
+	if [ "$expected_EASYRSA_PKI" ]; then
+		if [ "$expected_EASYRSA_PKI" = "$EASYRSA_PKI" ]; then
+			: # ok
+		else
+			if [ "$unexpected_error" ]; then
+				# Add a new-line Extra separator, for clarity
+				unexpected_error="${unexpected_error}${NL}${NL}"
+			fi
+			unexpected_error="${unexpected_error}\
+   EASYRSA_PKI: $EASYRSA_PKI
+      Expected: $expected_EASYRSA_PKI"
+		fi
+	fi
+
+	# Return no error
+	[ -z "$unexpected_error" ] && return
+
+	# This is an almost unacceptable error
+	invalid_vars=1
+	[ "$quiet_vars" ] || user_error "\
+The values in the vars file have unexpectedly changed the values for
+EASYRSA and/or EASYRSA_PKI. The default pki/vars file is forbidden to
+change these values.
+
+     vars-file: $EASYRSA_VARS_FILE
+
+${unexpected_error}"
+} # => validate_default_vars()
+
+# Create PKI lock-file, as necessary
+request_lock_file() {
+	if [ "$EASYRSA_NO_LOCKFILE" ]; then
+		verbose "request_lock_file; DISABLED"
+		return
+	fi
+
+	# Create lock-file
+	create_lock_file_error=
+	if [ -d "${EASYRSA_PKI}" ]; then
+		lock_file="${EASYRSA_PKI}"/lock.file
+		if create_lock_file "$lock_file"; then
+			verbose "request_lock_file; lock-file CREATED: $lock_file"
+		else
+			easyrsa_exit_with_error=17
+			if [ -f "$lock_file" ]; then
+				# Do not remove existing lock-file in batch mode
+				if [ "$EASYRSA_BATCH" ]; then
+					create_lock_file_error=1
+					cleanup
+				fi
+
+				# Allow user to remove lock-file
+				confirm "Remove existing lock-file ? " yes "
+ERROR: lock-file exists!
+
+If you are certain that easyrsa is not being used by another
+process then you can safely delete the existing lock-file
+and try running the easyrsa command again."
+
+				confirm "
+    *** SECOND WARNING ***
+
+  Remove existing lock-file ? " yes "
+========================================${NL}"
+
+				# remove_lock_file by FORCE
+				remove_lock_file "$lock_file" FORCE || \
+					die "Failed to FORCE remove lock-file!"
+
+				# quit now, force retry
+				notice "\
+lock-file removed - Please try running the easyrsa command again."
+				cleanup
+			else
+				die "Failed to create lock-file (permissions?)"
+			fi
+		fi
+	else
+		verbose "request_lock_file; lock-file not required."
+	fi
+} # => request_lock_file()
+
+# Verify working environment
+verify_working_env() {
+	fn_name="verify_working_env"
+
+	# Intelligent env-var detection and auto-loading:
+	# Select vars file as EASYRSA_VARS_FILE
+	# then source the vars file, if found
+	# otherwise, ignore no vars file
+	if select_vars; then
+		source_vars "$EASYRSA_VARS_FILE"
+		[ "$quiet_vars" ] || information "\
+Using Easy-RSA 'vars' configuration:
+* $EASYRSA_VARS_FILE"
+	fi
 
-	# pull filename base:
-	[ -n "$2" ] || die "\
-Error: didn't find a file base name as the first argument.
-Run easyrsa without commands for usage and commands."
-	local crt_type="$1" name="$2"
-	local req_out="$EASYRSA_PKI/reqs/$2.req"
-	local key_out="$EASYRSA_PKI/private/$2.key"
-	local crt_out="$EASYRSA_PKI/issued/$2.crt"
-	shift 2
+	# Initialisation requirements
+	unset -v \
+		OPENSSL_CONF \
+		verify_ssl_lib_ok ssl_batch \
+		secured_session write_recursion \
+		text prohibit_no_pass \
+		quiet_vars invalid_vars \
+		local_request error_build_full_cleanup \
+		selfsign_eku \
+		internal_batch mv_temp_error \
+		easyrsa_exit_with_error error_info \
+		prompt_restore mktemp_counter
 
-	# function opts support
-	local req_opts=
-	while [ -n "$1" ]; do
-		case "$1" in
-			nopass) req_opts="$req_opts nopass" ;;
-			*) warn "Ignoring unknown command option: '$1'" ;;
-		esac
-		shift
-	done
+	# Protect $EASYRSA_ALIAS_DAYS from vars abuse
+	[ "$EASYRSA_ALIAS_DAYS" = undefined ] && unset -v EASYRSA_ALIAS_DAYS
 
-	# abort on existing req/key/crt files
-	local err_exists="\
-file already exists. Aborting build to avoid overwriting this file.
-If you wish to continue, please use a different name or remove the file.
-Matching file found at: "
-	[ -f "$req_out" ] && die "Request $err_exists $req_out"
-	[ -f "$key_out" ] && die "Key $err_exists $key_out"
-	[ -f "$crt_out" ] && die "Certificate $err_exists $crt_out"
+	# then set defaults
+	default_vars
 
-	# create request
-	EASYRSA_REQ_CN="$name"
-	gen_req "$name" batch $req_opts
+	# Check for unexpected changes to EASYRSA or EASYRSA_PKI
+	# https://github.com/OpenVPN/easy-rsa/issues/1006
+	validate_default_vars
 
-	# Sign it
-	sign_req "$crt_type" "$name" batch
+	# Check for conflicting input options
+	mutual_exclusions
 
-} # => build_full()
+	# Find x509-types, openssl-easyrsa.cnf
+	locate_support_files
 
-# revoke backend
-revoke() {
-	verify_ca_init
+	# Verify SSL Lib - One time ONLY
+	verify_ssl_lib
 
-	# pull filename base:
-	[ -n "$1" ] || die "\
-Error: didn't find a file base name as the first argument.
-Run easyrsa without commands for usage and command help."
-	local crt_in="$EASYRSA_PKI/issued/$1.crt"
+	# Opportunist PKI lock-file
+	request_lock_file
 
-	verify_file x509 "$crt_in" || die "\
-Unable to revoke as the input file is not a valid certificate. Unexpected
-input in file: $crt_in"
+	# Verify PKI is initialised
+	if [ "$require_pki" ]; then
+		verify_pki_init
+	fi
 
-	# confirm operation by displaying DN:
-	confirm "Continue with revocation: " "yes" "
-Please confirm you wish to revoke the certificate with the following subject:
+	# Verify CA is initialised
+	if [ "$require_ca" ]; then
+		verify_ca_init
+	fi
 
-$(display_dn x509 "$crt_in")
-"	# => confirm end
+	# If there is a valid temp-dir:
+	# Create temp-session and global safe ssl config tmp-file
+	# if required, openssl-easyrsa.cnf tmp-file
+	if [ -d "$EASYRSA_TEMP_DIR" ]; then
+		verbose "temp-dir: FOUND: $EASYRSA_TEMP_DIR"
+		# Temp dir session
+		secure_session
 
-	# referenced cert must exist:
-	[ -f "$crt_in" ] || die "\
-Unable to revoke as no certificate was found. Certificate was expected
-at: $crt_in"
+		# if openssl-easyrsa.cnf does not exist then
+		# provide default as tmp-file via $EASYRSA_SSL_CONF
+		select_ssl_cnf_tmp
 
-	"$EASYRSA_OPENSSL" ca -utf8 -revoke "$crt_in" -config "$EASYRSA_SSL_CONF" || die "\
-Failed to revoke certificate: revocation command failed."
+		# global safe ssl cnf temp
+		write_global_safe_ssl_cnf_tmp
 
-	notice "\
-IMPORTANT!!!
+		# Verify selected algorithm and parameters
+		verify_algo_params
+	else
+		verbose "temp-dir: Missing: ${EASYRSA_TEMP_DIR:-undefined}"
+	fi
 
-Revocation was successful. You must run gen-crl and upload a CRL to your
-infrastructure in order to prevent the revoked cert from being accepted.
-"	# => notice end
-	return 0
-} #= revoke()
+	# Set command name for verbose messages
+	verbose "COMPLETED Handover-to: $cmd"
+	fn_name="$cmd"
+} # => verify_working_env()
 
-# gen-crl backend
-gen_crl() {
-	verify_ca_init
+# variable assignment by indirection.
+# Sets '$1' as the value contained in '$2'
+# and exports (may be blank)
+set_var() {
+	[ -z "$*" ] && return
+	[ -z "$3" ] || \
+		user_error "set_var - excess input '$*'"
+	case "$1" in
+		*=*) user_error "set_var - var '$1'"
+	esac
+	eval "export \"$1\"=\"\${$1-$2}\"" && return
+	die "set_var - eval '$*'"
+} # => set_var()
+
+# sanitize and set var
+# nix.sh/win.sh/busybox.sh never return error from unset
+# when an invalid variable name 'a=b' is used with a value
+# to set, eg. 'c'; This causes EasyRSA to execute:
+# eval "export a=b=c". 'set_var EASYRSA_PKI=pki' results in
+# $EASYRSA_PKI being set to 'pki=pki-', without error!
+# Guard against this possible user error with 'case'.
+force_set_var() {
+	[ -z "$3" ] || \
+		user_error "force_set_var - excess input '$*'"
+	case "$1" in
+		*=*) user_error "force_set_var - var '$1'"
+	esac
+	# force unsetting $1; Guard unset with '|| die', just in case
+	unset -v "$1" || die "force_set_var - unset '$1'"
+	# Allow empty value to unset variable by returning
+	[ "$2" ] || return 0
+	set_var "$1" "$2" && return
+	die "force_set_var - set_var '$*'"
+} # => force_set_var()
+
+# global Safe SSL conf file, for use by any SSL lib
+write_global_safe_ssl_cnf_tmp() {
+	global_safe_ssl_cnf_tmp=
+	easyrsa_mktemp global_safe_ssl_cnf_tmp
+	write_legacy_file_v2 safe-cnf "$global_safe_ssl_cnf_tmp" \
+		overwrite || die "verify_working_env - write safe-cnf"
+	export OPENSSL_CONF="$global_safe_ssl_cnf_tmp"
+	verbose "\
+write_global_safe_ssl_cnf_tmp; GLOBAL OPENSSL_CONF = $OPENSSL_CONF"
+} # => write_global_safe_ssl_cnf_tmp()
+
+# if openssl-easyrsa.cnf does exist and it is customised then
+# copy it to tmp-file. Otherwise, provide default as tmp-file
+# Always export tmpfile to $EASYRSA_SSL_CONF
+# No expansion required for safe SSL config
+select_ssl_cnf_tmp() {
+	# Always write a temp-file
+	ssl_conf_tmp=
+	easyrsa_mktemp ssl_conf_tmp
+	copy_ssl_conf_tmp=
+
+	if [ -f "$EASYRSA_SSL_CONF" ]; then
+		if ! check_ssl_cnf_known_hash "$EASYRSA_SSL_CONF"; then
+			copy_ssl_conf_tmp=1
+		fi
+	fi
 
-	local out_file="$EASYRSA_PKI/crl.pem"
-	out_file_tmp="$(mktemp -u "$out_file.XXXXXXXXXX")"; EASYRSA_TEMP_FILE_2="$out_file_tmp"
-	"$EASYRSA_OPENSSL" ca -utf8 -gencrl -out "$out_file_tmp" -config "$EASYRSA_SSL_CONF" || die "\
-CRL Generation failed.
-"
-	mv "$out_file_tmp" "$out_file"; EASYRSA_TEMP_FILE_2=
+	if [ "$copy_ssl_conf_tmp" ]; then
+		# copy existing, custom openssl-easyrsa.cnf file
+		verbose "select_ssl_cnf_tmp; copy existing ssl-cnf to tmp-file"
+		cp "$EASYRSA_SSL_CONF" "$ssl_conf_tmp" || \
+			die "select_ssl_cnf_tmp - copy existing SSL config"
+	else
+		# create EasyRSA default SSL config file
+		verbose "select_ssl_cnf_tmp; write built-in ssl-cnf to tmp-file"
+		write_legacy_file_v2 ssl-cnf "$ssl_conf_tmp" overwrite || \
+			die "select_ssl_cnf_tmp - write_legacy_file_v2 ssl-cnf"
+	fi
 
-	notice "\
-An updated CRL has been created.
-CRL file: $out_file
-"
-	return 0
-} # => gen_crl()
+	export EASYRSA_SSL_CONF="$ssl_conf_tmp"
+	verbose "select_ssl_cnf_tmp; EASYRSA_SSL_CONF = '$EASYRSA_SSL_CONF'"
+	unset -v ssl_conf_tmp copy_ssl_conf_tmp
+} # => select_ssl_cnf_tmp()
+
+# Check if 'openssl-easyrsa.cnf' hash is known
+check_ssl_cnf_known_hash() {
+	# Get file hash
+	file_hash="$(
+		"$EASYRSA_OPENSSL" dgst -sha256 -r "$1" 2>/dev/null
+	)" || die "check_ssl_cnf_known_hash - hash malfunction!"
+
+	# Strip excess SSL info
+	file_hash="${file_hash%% *}"
+
+	# Compare SSL output
+	case "$file_hash" in
+	*[!1234567890abcdef]*|'')
+		die "check_ssl_cnf_known_hash - hash failure!"
+		;;
+	# known hashes
+	# 3.1.7 -> Current
+	"13ca05f031d58c5e2912652b33099ce9ac05f49595e5d5fe96367229e3ce070c")
+		;;
+	# 3.1.5 -> 3.1.6
+	"87d51ca0db1cc0ac3cc2634792fc5576e0034ebf9d546de11674b897514f3afb")
+		;;
+	# 3.1.0 -> 3.1.4
+	"5455947df40f01f845bf79c1e89f102c628faaa65d71a6512d0e17bdd183feb0")
+		;;
+	# 3.0.8 -> 3.0.9
+	"1cc6a1de93ca357b5c364aa0fa2c4beaf97425686fa1976d436fa31f550641aa")
+		;;
+	# Built-in here-doc 3.2.0
+	"82439f1860838e28f6270d5d06b1771756db777861e19bf9edc21222f86a310d")
+		;;
+	*)
+		verbose "check_ssl_cnf_known_hash; UNKNOWN $file_hash"
+		return 1
+	esac
+	verbose "check_ssl_cnf_known_hash; KNOWN $file_hash"
+} # => check_ssl_cnf_known_hash()
+
+# Select ANY existing X509-type file or
+# create a tmp-file for supported types
+# copy the selected file to a new tmp-file
+select_x509_type_tmp() {
+	[ "$1" ] || die "create_x509_type_tmp - input: type"
+	x509_type_source="${EASYRSA_EXT_DIR}/${1}"
+
+	# If no X509-type file exists then provide known types or fail
+	if [ ! -f "$x509_type_source" ]; then
+		# Use a temp file
+		write_x509_type_tmp "$1"
+		x509_type_source="$write_x509_file_tmp"
+	fi
 
-# import-req backend
-import_req() {
-	verify_pki_init
+	# Copy the x509-types/$x509_type file to tmp-file
+	new_x509_type_file_tmp=
+	easyrsa_mktemp new_x509_type_file_tmp
 
-	# pull passed paths
-	local in_req="$1" short_name="$2"
-	local out_req="$EASYRSA_PKI/reqs/$2.req" 
+	cp "$x509_type_source" "$new_x509_type_file_tmp" || \
+		die "select_x509_type_tmp; copy x509-type failed"
 
-	[ -n "$short_name" ] || die "\
-Unable to import: incorrect command syntax.
-Run easyrsa without commands for usage and command help."
+	verbose "\
+select_x509_type_tmp; new_x509_type_file_tmp = '$new_x509_type_file_tmp'"
+} # => select_x509_type_tmp()
 
-	verify_file req "$in_req" || die "\
-The input file does not appear to be a certificate request. Aborting import.
-Offending file: $in_req"
+# Write x509 type file to a temp file
+write_x509_type_tmp() {
+	# Verify x509-type before redirect
+	case "$1" in
+		COMMON|ca|server|serverClient|client|email|codeSigning)
+			: # ok
+		;;
+		selfsign)
+			[ "$2" = batch ] || die "X509 selfsign only allowed internally"
+		;;
+		*)
+			die "write_x509_type_tmp - unknown type '$1'"
+	esac
 
-	# destination must not exist
-	[ -f "$out_req" ] && die "\
-Unable to import the request as the destination file already exists.
-Please choose a different name for your imported request file.
-Existing file at: $out_req"
-	
-	# now import it
-	cp "$in_req" "$out_req"
+	# $write_x509_file_tmp is returned as the new temp-file, to the caller
+	write_x509_file_tmp=
+	easyrsa_mktemp write_x509_file_tmp
 
-	notice "\
-The request has been successfully imported with a short name of: $short_name
-You may now use this name to perform signing operations on this request.
-"
-	return 0
-} # => import_req()
+	write_legacy_file_v2 "$1" "$write_x509_file_tmp" overwrite || \
+		die "write_x509_type_tmp - write $1"
 
-# export pkcs#12 or pkcs#7
-export_pkcs() {
-	local pkcs_type="$1"
-	shift
+	verbose "write_x509_type_tmp; '$1' COMPLETE"
+} # => write_x509_type_tmp()
 
-	[ -n "$1" ] || die "\
-Unable to export p12: incorrect command syntax.
-Run easyrsa without commands for usage and command help."
+############################################################################
+#
+# Create legacy files
+#
 
-	local short_name="$1"
-	local crt_in="$EASYRSA_PKI/issued/$1.crt"
-	local key_in="$EASYRSA_PKI/private/$1.key"
-	local crt_ca="$EASYRSA_PKI/ca.crt"
-	shift
+# Write ALL legacy files to default name with optional 'overwrite'
+all_legacy_files_v2() {
+	# Confirm over write
+	if [ "$1" ]; then
+		confirm "${NL}  Confirm OVER-WRITE files ? " yes "
+Warning:
+'legacy-hard' will OVER-WRITE all legacy files to default settings.
 
-	verify_pki_init
+Legacy files:
+* File: ${EASYRSA_PKI}/openssl-easyrsa.cnf
+* File: ${EASYRSA_PKI}/vars.example
+* Dir:  ${EASYRSA_PKI}/x509-types/*"
 
-	# opts support
-	local want_ca=1
-	local want_key=1
-	while [ -n "$1" ]; do
-		case "$1" in
-			noca) want_ca= ;;
-			nokey) want_key= ;;
-			*) warn "Ignoring unknown command option: '$1'" ;;
-		esac
-		shift
+		verbose "all_legacy_files_v2; over-write ENABLED"
+	else
+		verbose "all_legacy_files_v2; over-write DISABLED"
+	fi
+
+	# Output directories
+	x509_types_d="$EASYRSA_PKI"/x509-types
+	mkdir -p "$x509_types_d" || die \
+		"all_legacy_files_v2() - Failed to create '$x509_types_d' directory."
+
+	# Create x509-types, except selfsign
+	for legacy_type in COMMON ca server serverClient client \
+		email codeSigning
+	do
+		legacy_target="${x509_types_d}/${legacy_type}"
+		write_legacy_file_v2 "$legacy_type" "$legacy_target" "$1"
 	done
 
-	local pkcs_opts=
-	if [ $want_ca ]; then
-		verify_file x509 "$crt_ca" || die "\
-Unable to include CA cert in the $pkcs_type output (missing file, or use noca option.)
-Missing file expected at: $crt_ca"
-		pkcs_opts="$pkcs_opts -certfile $crt_ca"
-	fi
+	# vars.example
+	legacy_type=vars
+	legacy_target="$EASYRSA_PKI"/vars.example
+	write_legacy_file_v2 "$legacy_type" "$legacy_target" "$1"
 
-	# input files must exist
-	verify_file x509 "$crt_in" || die "\
-Unable to export $pkcs_type for short name '$short_name' without the certificate.
-Missing cert expected at: $crt_in"
+	# openssl-easyrsa.cnf
+	legacy_type=ssl-cnf
+	legacy_target="$EASYRSA_PKI"/openssl-easyrsa.cnf
+	write_legacy_file_v2 "$legacy_type" "$legacy_target" "$1"
 
-	case "$pkcs_type" in
-	p12)
-		local pkcs_out="$EASYRSA_PKI/private/$short_name.p12"
+	# User notice
+	if [ "$1" ]; then
+		notice "legacy-hard has updated all files."
+	else
+		notice "legacy has updated missing files."
+	fi
+} # => all_legacy_files_v2()
+
+# write legacy files to stdout or user defined file
+write_legacy_file_v2() {
+	# recursion check
+	write_recursion="$(( write_recursion + 1 ))"
+	if [ "$write_recursion" -gt 1 ]; then
+		print "write recursion" > "$easyrsa_err_log"
+		die "write recursion"
+	fi
+
+	# Always required 'type'
+	write_type="$1"
+	# Only allowed by internal callers
+	write_file="$2"
+	write_over=
+	[ "$3" = overwrite ] && write_over=1
+
+	# Select by type
+	case "$write_type" in
+	ssl-cnf)
+		set_openssl_easyrsa_cnf_vars unexpanded
+		;;
+	safe-cnf)
+		set_openssl_easyrsa_cnf_vars expanded
+		;;
+	vars)
+		;;
+	# This correctly renames 'code-signing' to 'codeSigning'
+	COMMON|ca|server|serverClient|client|codeSigning|email)
+		;;
+	selfsign)
+		;;
+	*)
+		user_error "write - unknown type '$write_type'"
+	esac
 
-		if [ $want_key ]; then
-			[ -f "$key_in" ] || die "\
-Unable to export p12 for short name '$short_name' without the key
-(if you want a p12 without the private key, use nokey option.)
-Missing key expected at: $key_in"
+	# If $write_file is given then establish overwrite rules
+	# write legacy data stream to stdout or file
+	if [ -f "$write_file" ]; then
+		if [ "$write_over" ]; then
+			verbose "write_legacy_file_v2; over-write ENABLED for $write_type"
+			create_legacy_stream "$write_type" > "$write_file" || \
+				die "write over-write failed"
 		else
-			pkcs_opts="$pkcs_opts -nokeys"
+			# Preserve existing file and continue
+			warn "write_legacy_file_v2; over-write BLOCKED for $write_type"
 		fi
+	# $write_file does not exist, so create it
+	elif [ "$write_file" ]; then
+			verbose "write_legacy_file_v2; over-write IGNORED for $write_type"
+			create_legacy_stream "$write_type" > "$write_file" || \
+				die "write failed"
+	else
+		# write stream to stdout ONLY
+		create_legacy_stream "$write_type"
+	fi
 
-		# export the p12:
-		"$EASYRSA_OPENSSL" pkcs12 -in "$crt_in" -inkey "$key_in" -export \
-			-out "$pkcs_out" $pkcs_opts || die "\
-Export of p12 failed: see above for related openssl errors."
-	;;
-	p7)
-		local pkcs_out="$EASYRSA_PKI/issued/$short_name.p7b"
-
-		# export the p7:
-		"$EASYRSA_OPENSSL" crl2pkcs7 -nocrl -certfile "$crt_in" \
-			-out "$pkcs_out" $pkcs_opts || die "\
-Export of p7 failed: see above for related openssl errors."
-	;;
-esac
+	write_recursion="$(( write_recursion - 1 ))"
+} # => write_legacy_file_v2()
 
-	notice "\
-Successful export of $pkcs_type file. Your exported file is at the following
-location: $pkcs_out
-"
-	return 0
-} # => export_pkcs()
+# set heredoc variables for openssl-easyrsa.cnf
+# shellcheck disable=SC2016 # (info): $ don't expand in ''
+set_openssl_easyrsa_cnf_vars() {
+	case "$1" in
+	expanded)
+		# fully expand ssl-cnf for safe-cnf
+		conf_EASYRSA_dir="$EASYRSA_PKI"
+		conf_EASYRSA_PKI="$EASYRSA_PKI"
+		conf_EASYRSA_DIGEST="$EASYRSA_DIGEST"
+		conf_EASYRSA_KEY_SIZE="$EASYRSA_KEY_SIZE"
+		conf_EASYRSA_DN="$EASYRSA_DN"
+		conf_EASYRSA_REQ_CN="$EASYRSA_REQ_CN"
+		conf_EASYRSA_REQ_COUNTRY="$EASYRSA_REQ_COUNTRY"
+		conf_EASYRSA_REQ_PROVINCE="$EASYRSA_REQ_PROVINCE"
+		conf_EASYRSA_REQ_CITY="$EASYRSA_REQ_CITY"
+		conf_EASYRSA_REQ_ORG="$EASYRSA_REQ_ORG"
+		conf_EASYRSA_REQ_OU="$EASYRSA_REQ_OU"
+		conf_EASYRSA_REQ_EMAIL="$EASYRSA_REQ_EMAIL"
+		conf_EASYRSA_REQ_SERIAL="$EASYRSA_REQ_SERIAL"
+		;;
+	unexpanded)
+		# write standard ssl-cnf
+		conf_EASYRSA_dir='$dir'
+		conf_EASYRSA_PKI='$ENV::EASYRSA_PKI'
+		conf_EASYRSA_DIGEST='$ENV::EASYRSA_DIGEST'
+		conf_EASYRSA_KEY_SIZE='$ENV::EASYRSA_KEY_SIZE'
+		conf_EASYRSA_DN='$ENV::EASYRSA_DN'
+		conf_EASYRSA_REQ_CN='$ENV::EASYRSA_REQ_CN'
+		conf_EASYRSA_REQ_COUNTRY='$ENV::EASYRSA_REQ_COUNTRY'
+		conf_EASYRSA_REQ_PROVINCE='$ENV::EASYRSA_REQ_PROVINCE'
+		conf_EASYRSA_REQ_CITY='$ENV::EASYRSA_REQ_CITY'
+		conf_EASYRSA_REQ_ORG='$ENV::EASYRSA_REQ_ORG'
+		conf_EASYRSA_REQ_OU='$ENV::EASYRSA_REQ_OU'
+		conf_EASYRSA_REQ_EMAIL='$ENV::EASYRSA_REQ_EMAIL'
+		conf_EASYRSA_REQ_SERIAL='$ENV::EASYRSA_REQ_SERIAL'
+		;;
+	*)
+		die "set_openssl_easyrsa_cnf_vars - input"
+	esac
+} # => set_openssl_easyrsa_cnf_vars()
 
-# set-pass backend
-set_pass() {
-	verify_pki_init
+# Create x509 type
+create_legacy_stream() {
+	case "$1" in
+	COMMON)
+	# COMMON is not very useful
+		cat <<- "CREATE_X509_TYPE_COMMON"
+		CREATE_X509_TYPE_COMMON
+		;;
+	easyrsa)
+	# This could be COMMON but not is not suitable for a CA
+		cat <<- "CREATE_X509_TYPE_EASYRSA"
+		basicConstraints = CA:FALSE
+		subjectKeyIdentifier = hash
+		authorityKeyIdentifier = keyid,issuer:always
+		keyUsage = digitalSignature,keyEncipherment
+		CREATE_X509_TYPE_EASYRSA
+		;;
+	serverClient)
+	# serverClient
+		create_legacy_stream easyrsa
+		cat <<- "CREATE_X509_TYPE_SERV_CLI"
+		extendedKeyUsage = serverAuth,clientAuth
+		CREATE_X509_TYPE_SERV_CLI
+		;;
+	server)
+	# server
+		create_legacy_stream easyrsa
+		cat <<- "CREATE_X509_TYPE_SERV"
+		extendedKeyUsage = serverAuth
+		CREATE_X509_TYPE_SERV
+		;;
+	client)
+	# client
+		create_legacy_stream easyrsa
+		cat <<- "CREATE_X509_TYPE_CLI"
+		extendedKeyUsage = clientAuth
+		CREATE_X509_TYPE_CLI
+		;;
+	ca)
+	# ca
+		cat <<- "CREATE_X509_TYPE_CA"
+		basicConstraints = critical,CA:TRUE
+		subjectKeyIdentifier = hash
+		authorityKeyIdentifier = keyid:always,issuer:always
+		keyUsage = cRLSign, keyCertSign
+		CREATE_X509_TYPE_CA
+		;;
+	selfsign)
+	# selfsign
+		cat <<- "CREATE_X509_TYPE_SELFSIGN"
+		# WARNING: 'selfsign' is NOT a user configurable X509-type file.
+		subjectKeyIdentifier = hash
+		authorityKeyIdentifier = keyid:always,issuer:always
+		basicConstraints = CA:TRUE
+		keyUsage = digitalSignature,keyEncipherment
+		CREATE_X509_TYPE_SELFSIGN
+
+		print "extendedKeyUsage = $selfsign_eku"
+		;;
+	codeSigning)
+	# codeSigning
+		cat <<- "CREATE_X509_CODE_SIGNING"
+		basicConstraints = CA:FALSE
+		subjectKeyIdentifier = hash
+		authorityKeyIdentifier = keyid,issuer:always
+		extendedKeyUsage = codeSigning
+		keyUsage = digitalSignature
+		CREATE_X509_CODE_SIGNING
+		;;
+	email)
+	# email
+		cat <<- "CREATE_X509_TYPE_EMAIL"
+		basicConstraints = CA:FALSE
+		subjectKeyIdentifier = hash
+		authorityKeyIdentifier = keyid,issuer:always
+		extendedKeyUsage = emailProtection
+		keyUsage = digitalSignature,keyEncipherment,nonRepudiation
+		CREATE_X509_TYPE_EMAIL
+		;;
+	vars)
+	# vars
+		cat << "CREATE_VARS_EXAMPLE"
+# Easy-RSA 3 parameter settings
 
-	# key type, supplied internally from frontend command call (rsa/ec)
-	local key_type="$1"
+# NOTE: If you installed Easy-RSA from your package manager, do not edit
+# this file in place -- instead, you should copy the entire easy-rsa directory
+# to another location so future upgrades do not wipe out your changes.
 
-	# values supplied by the user:
-	local raw_file="$2"
-	local file="$EASYRSA_PKI/private/$raw_file.key"
-	[ -n "$raw_file" ] || die "\
-Missing argument to 'set-$key_type-pass' command: no name/file supplied.
-See help output for usage details."
+# HOW TO USE THIS FILE
+#
+# vars.example contains built-in examples to Easy-RSA settings. You MUST name
+# this file "vars" if you want it to be used as a configuration file. If you
+# do not, it WILL NOT be automatically read when you call easyrsa commands.
+#
+# It is not necessary to use this config file unless you wish to change
+# operational defaults. These defaults should be fine for many uses without
+# the need to copy and edit the "vars" file.
+#
+# All of the editable settings are shown commented and start with the command
+# "set_var" -- this means any set_var command that is uncommented has been
+# modified by the user. If you are happy with a default, there is no need to
+# define the value to its default.
 
-	# parse command options
-	shift 2
-	local crypto="-aes256"
-	while [ -n "$1" ]; do
-		case "$1" in
-			nopass)	crypto= ;;
-			file)	file="$raw_file" ;;
-			*)	warn "Ignoring unknown command option: '$1'" ;;
-		esac
-		shift
-	done
+# NOTES FOR WINDOWS USERS
+#
+# Paths for Windows  *MUST* use forward slashes, or optionally double-escaped
+# backslashes (single forward slashes are recommended.) This means your path
+# to the openssl binary might look like this:
+# "C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
 
-	[ -f "$file" ] || die "\
-Missing private key: expected to find the private key component at:
-$file"
+# A little housekeeping: DO NOT EDIT THIS SECTION
+#
+# Easy-RSA 3.x does not source into the environment directly.
+# Complain if a user tries to do this:
+if [ -z "$EASYRSA_CALLER" ]; then
+	echo "You appear to be sourcing an Easy-RSA *vars* file. This is" >&2
+	echo "no longer necessary and is disallowed. See the section called" >&2
+	echo "*How to use this file* near the top comments for more details." >&2
+	return 1
+fi
+
+# DO YOUR EDITS BELOW THIS POINT
+
+# If your OpenSSL command is not in the system PATH, you will need to define
+# the path here. Normally this means a full path to the executable, otherwise
+# you could have left it undefined here and the shown default would be used.
+#
+# Windows users, remember to use paths with forward-slashes (or escaped
+# back-slashes.) Windows users should declare the full path to the openssl
+# binary here if it is not in their system PATH.
+#
+#set_var EASYRSA_OPENSSL	"openssl"
+#
+# This sample is in Windows syntax -- edit it for your path if not using PATH:
+#set_var EASYRSA_OPENSSL	"C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
 
-	notice "\
-If the key is currently encrypted you must supply the decryption passphrase.
-${crypto:+You will then enter a new PEM passphrase for this key.$NL}"
+# Windows users, to generate OpenVPN TLS Keys the Openvpn binary must be
+# defined here.
+#
+#set_var EASYRSA_OPENVPN "C:\\Program Files\\Openvpn\\bin\\openvpn.exe"
 
-	"$EASYRSA_OPENSSL" $key_type -in "$file" -out "$file" $crypto || die "\
-Failed to change the private key passphrase. See above for possible openssl
-error messages."
+# Define X509 DN mode.
+#
+# This is used to adjust which elements are included in the Subject field
+# as the DN ("Distinguished Name"). Note that in 'cn_only' mode the
+# Organizational fields, listed further below, are not used.
+#
+# Choices are:
+#   cn_only  - Use just a commonName value.
+#   org      - Use the "traditional" format:
+#              Country/Province/City/Org/Org.Unit/email/commonName
+#
+#set_var EASYRSA_DN	"cn_only"
 
-	notice "Key passphrase successfully changed"
-	
-} # => set_pass()
+# Organizational fields (used with "org" mode and ignored in "cn_only" mode).
+# These are the default values for fields which will be placed in the
+# certificate.  Do not leave any of these fields blank, although interactively
+# you may omit any specific field by typing the "." symbol (not valid for
+# email).
+#
+# NOTE: The following characters are not supported
+#       in these "Organizational fields" by Easy-RSA:
+#       back-tick (`)
+#
+#set_var EASYRSA_REQ_COUNTRY	"US"
+#set_var EASYRSA_REQ_PROVINCE	"California"
+#set_var EASYRSA_REQ_CITY	"San Francisco"
+#set_var EASYRSA_REQ_ORG	"Copyleft Certificate Co"
+#set_var EASYRSA_REQ_EMAIL	"me@example.net"
+#set_var EASYRSA_REQ_OU		"My Organizational Unit"
+
+# Preserve the Distinguished Name field order
+# of the certificate signing request
+# *Only* effective in --dn-mode=org
+#
+#set_var EASYRSA_PRESERVE_DN	1
 
-# update-db backend
-update_db() {
-	verify_ca_init
+# Set no password mode - This will create the entire PKI without passwords.
+# This can be better managed by choosing which entity private keys should be
+# encrypted with the following command line options:
+# Global option '--no-pass' or command option 'nopass'.
+#
+#set_var EASYRSA_NO_PASS	1
 
-	"$EASYRSA_OPENSSL" ca -utf8 -updatedb -config "$EASYRSA_SSL_CONF" || die "\
-Failed to perform update-db: see above for related openssl errors."
-	return 0
-} # => update_db()
+# Choose a size in bits for your keypairs. The recommended value is 2048.
+# Using 2048-bit keys is considered more than sufficient for many years into
+# the future. Larger keysizes will slow down TLS negotiation and make key/DH
+# param generation take much longer. Values up to 4096 should be accepted by
+# most software. Only used when the crypto alg is rsa, see below.
+#
+#set_var EASYRSA_KEY_SIZE	2048
+
+# The default crypto mode is rsa; ec can enable elliptic curve support.
+# Note that not all software supports ECC, so use care when enabling it.
+# Choices for crypto alg are: (each in lower-case)
+#  * rsa
+#  * ec
+#  * ed
+#
+#set_var EASYRSA_ALGO		rsa
 
-# display cert DN info on a req/X509, passed by full pathname
-display_dn() {
-	local format="$1" path="$2"
-	print "$("$EASYRSA_OPENSSL" $format -in "$path" -noout -subject -nameopt multiline)"
-} # => display_dn()
+# Define the named curve, used in ec & ed modes:
+#
+#set_var EASYRSA_CURVE		secp384r1
 
-# verify a file seems to be a valid req/X509
-verify_file() {
-	local format="$1" path="$2"
-	"$EASYRSA_OPENSSL" $format -in "$path" -noout 2>/dev/null || return 1
-	return 0
-} # => verify_x509()
+# In how many days should the root CA key expire?
+#
+#set_var EASYRSA_CA_EXPIRE	3650
 
-# show-* command backend
-# Prints req/cert details in a readable format
-show() {
-	local type="$1" name="$2" in_file format
-	[ -n "$name" ] || die "\
-Missing expected filename_base argument.
-Run easyrsa without commands for usage help."
-	shift 2
+# In how many days should certificates expire?
+#
+#set_var EASYRSA_CERT_EXPIRE	825
 
-	# opts support
-	local opts="-${type}opt no_pubkey,no_sigdump"
-	while [ -n "$1" ]; do
-		case "$1" in
-			full) opts= ;;
-			*) warn "Ignoring unknown command option: '$1'" ;;
-		esac
-		shift
-	done
+# How many days until the Certificate Revokation List will expire.
+#
+# IMPORTANT: When the CRL expires, an OpenVPN Server which uses a
+# CRL will reject ALL new connections, until the CRL is replaced.
+#
+#set_var EASYRSA_CRL_DAYS	180
 
-	# Determine cert/req type
-	if [ "$type" = "cert" ]; then
-		verify_ca_init
-		in_file="$EASYRSA_PKI/issued/${name}.crt"
-		format="x509"
-	else
-		verify_pki_init
-		in_file="$EASYRSA_PKI/reqs/${name}.req"
-		format="req"
-	fi
+# Random serial numbers by default.
+# Set to 'no' for the old incremental serial numbers.
+#
+#set_var EASYRSA_RAND_SN	"yes"
 
-	# Verify file exists and is of the correct type
-	[ -f "$in_file" ] || die "\
-No such $type file with a basename of '$name' is present.
-Expected to find this file at:
-$in_file"
-	verify_file $format "$in_file" || die "\
-This file is not a valid $type file:
-$in_file"
+# Cut-off window for checking expiring certificates.
+#
+#set_var EASYRSA_PRE_EXPIRY_WINDOW	90
 
-	notice "\
-Showing $type details for '$name'.
-This file is stored at:
-$in_file
-"
-	"$EASYRSA_OPENSSL" $format -in "$in_file" -noout -text\
-		-nameopt multiline $opts || die "\
-OpenSSL failure to process the input"
-} # => show()
+# Generate automatic subjectAltName for certificates
+#
+#set_var	EASYRSA_AUTO_SAN	1
 
-# vars setup
-# Here sourcing of 'vars' if present occurs. If not present, defaults are used
-# to support running without a sourced config format
-vars_setup() {
-	# Try to locate a 'vars' file in order of location preference.
-	# If one is found, source it
-	local vars=
-
-	# set up program path
-	local prog_vars="${0%/*}/vars"
-
-	# command-line path:
-	if [ -f "$EASYRSA_VARS_FILE" ]; then
-		vars="$EASYRSA_VARS_FILE"
-	# EASYRSA_PKI, if defined:
-	elif [ -n "$EASYRSA_PKI" ] && [ -f "$EASYRSA_PKI/vars" ]; then
-		vars="$EASYRSA_PKI/vars"
-	# EASYRSA, if defined:
-	elif [ -n "$EASYRSA" ] && [ -f "$EASYRSA/vars" ]; then
-		vars="$EASYRSA/vars"
-	# program location:
-	elif [ -f "$prog_vars" ]; then
-		vars="$prog_vars"
-	fi
-	
-	# If a vars file was located, source it
-	# If $EASYRSA_NO_VARS is defined (not blank) this is skipped
-	if [ -z "$EASYRSA_NO_VARS" ] && [ -n "$vars" ]; then
-		EASYRSA_CALLER=1 . "$vars"
-		notice "\
-Note: using Easy-RSA configuration from: $vars"
-	fi
-	
-	# Set defaults, preferring existing env-vars if present
-	set_var EASYRSA		"$PWD"
-	set_var EASYRSA_OPENSSL	openssl
-	set_var EASYRSA_PKI	"$EASYRSA/pki"
-	set_var EASYRSA_DN	cn_only
-	set_var EASYRSA_REQ_COUNTRY	"US"
-	set_var EASYRSA_REQ_PROVINCE	"California"
-	set_var EASYRSA_REQ_CITY	"San Francisco"
-	set_var EASYRSA_REQ_ORG		"Copyleft Certificate Co"
-	set_var EASYRSA_REQ_EMAIL	me@example.net
-	set_var EASYRSA_REQ_OU		"My Organizational Unit"
-	set_var EASYRSA_ALGO		rsa
-	set_var EASYRSA_KEY_SIZE	2048
-	set_var EASYRSA_CURVE		secp384r1
-	set_var EASYRSA_EC_DIR		"$EASYRSA_PKI/ecparams"
-	set_var EASYRSA_CA_EXPIRE	3650
-	set_var EASYRSA_CERT_EXPIRE	3650
-	set_var EASYRSA_CRL_DAYS	180
-	set_var EASYRSA_NS_SUPPORT	no
-	set_var EASYRSA_NS_COMMENT	"Easy-RSA Generated Certificate"
-	set_var EASYRSA_TEMP_FILE	"$EASYRSA_PKI/extensions.temp"
-	set_var EASYRSA_TEMP_FILE_2	""
-	set_var EASYRSA_TEMP_FILE_3	""
-	set_var EASYRSA_REQ_CN		ChangeMe
-	set_var EASYRSA_DIGEST		sha256
-
-	# Detect openssl config, preferring EASYRSA_PKI over EASYRSA
-	if [ -f "$EASYRSA_PKI/openssl-1.0.cnf" ]; then
-		set_var EASYRSA_SSL_CONF	"$EASYRSA_PKI/openssl-1.0.cnf"
-	else	set_var EASYRSA_SSL_CONF	"$EASYRSA/openssl-1.0.cnf"
-	fi
-
-	# Same as above for the x509-types extensions dir
-	if [ -d "$EASYRSA_PKI/x509-types" ]; then
-		set_var EASYRSA_EXT_DIR		"$EASYRSA_PKI/x509-types"
-	else	set_var EASYRSA_EXT_DIR		"$EASYRSA/x509-types"
-	fi
-
-	# EASYRSA_ALGO_PARAMS must be set depending on selected algo
-	if [ "ec" = "$EASYRSA_ALGO" ]; then
-		EASYRSA_ALGO_PARAMS="$EASYRSA_EC_DIR/${EASYRSA_CURVE}.pem"
-	elif [ "rsa" = "$EASYRSA_ALGO" ]; then
-		EASYRSA_ALGO_PARAMS="${EASYRSA_KEY_SIZE}"
-	else
-		die "Alg '$EASYRSA_ALGO' is invalid: must be 'rsa' or 'ec'"
-	fi
+# Add critical attribute to X509 fields: basicConstraints (BC),
+# keyUsage (KU), extendedKeyUsage (EKU) or SAN
+#
+#set_var	EASYRSA_BC_CRIT		1
+#set_var	EASYRSA_KU_CRIT		1
+#set_var	EASYRSA_EKU_CRIT	1
+#set_var	EASYRSA_SAN_CRIT	1
 
-	# Setting OPENSSL_CONF prevents bogus warnings (especially useful on win32)
-	export OPENSSL_CONF="$EASYRSA_SSL_CONF"
-} # vars_setup()
+# Disable automatic inline files
+#
+#set_var	EASYRSA_NO_INLINE	1
+CREATE_VARS_EXAMPLE
+		;;
+	ssl-cnf|safe-cnf)
+	# SSL config v3.2.0-1
+	cat << CREATE_SSL_CONFIG
+# For use with Easy-RSA 3.0+ and OpenSSL or LibreSSL
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= $conf_EASYRSA_PKI	# Where everything is kept
+certs		= $conf_EASYRSA_dir			# Where the issued certs are kept
+crl_dir		= $conf_EASYRSA_dir			# Where the issued crl are kept
+database	= $conf_EASYRSA_dir/index.txt	# database index file.
+new_certs_dir	= $conf_EASYRSA_dir/certs_by_serial	# default place for new certs.
+
+certificate	= $conf_EASYRSA_dir/ca.crt		# The CA certificate
+serial		= $conf_EASYRSA_dir/serial		# The current serial number
+crl		= $conf_EASYRSA_dir/crl.pem		# The current CRL
+private_key	= $conf_EASYRSA_dir/private/ca.key	# The private key
+RANDFILE	= $conf_EASYRSA_dir/.rand		# private random number file
+
+x509_extensions	= basic_exts		# The extensions to add to the cert
+
+# A placeholder to handle the --copy-ext feature:
+#%COPY_EXTS%	# Do NOT remove or change this line as --copy-ext support requires it
+
+# This allows a V2 CRL. Ancient browsers don't like it, but anything Easy-RSA
+# is designed for will. In return, we get the Issuer attached to CRLs.
+crl_extensions	= crl_ext
+
+# These fields are always configured via the command line.
+# These fields are removed from this here-doc but retained
+# in 'openssl-easyrsa.cnf' file, in case something breaks.
+# default_days is no longer required by Easy-RSA
+#default_days	= \$ENV::EASYRSA_CERT_EXPIRE	# how long to certify for
+# default_crl_days is no longer required by Easy-RSA
+#default_crl_days	= \$ENV::EASYRSA_CRL_DAYS	# how long before next CRL
+
+default_md	= $conf_EASYRSA_DIGEST		# use public key default MD
+preserve	= no			# keep passed DN ordering
+
+# This allows to renew certificates which have not been revoked
+unique_subject	= no
+
+# A few different ways of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_anything
+
+# For the 'anything' policy, which defines allowed DN fields
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+serialNumber	= optional
+
+####################################################################
+# Easy-RSA request handling
+# We key off \$DN_MODE to determine how to format the DN
+[ req ]
+default_bits		= $conf_EASYRSA_KEY_SIZE
+default_keyfile	= privkey.pem
+default_md		= $conf_EASYRSA_DIGEST
+distinguished_name	= $conf_EASYRSA_DN
+x509_extensions		= easyrsa_ca	# The extensions to add to the self signed cert
+
+# A placeholder to handle the \$EXTRA_EXTS feature:
+#%EXTRA_EXTS%	# Do NOT remove or change this line as \$EXTRA_EXTS support requires it
+
+####################################################################
+# Easy-RSA DN (Subject) handling
+
+# Easy-RSA DN for cn_only support:
+[ cn_only ]
+commonName		= Common Name (eg: your user, host, or server name)
+commonName_max		= 64
+commonName_default	= $conf_EASYRSA_REQ_CN
+
+# Easy-RSA DN for org support:
+[ org ]
+countryName			= Country Name (2 letter code)
+countryName_default		= $conf_EASYRSA_REQ_COUNTRY
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= $conf_EASYRSA_REQ_PROVINCE
+
+localityName			= Locality Name (eg, city)
+localityName_default		= $conf_EASYRSA_REQ_CITY
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= $conf_EASYRSA_REQ_ORG
+
+organizationalUnitName		= Organizational Unit Name (eg, section)
+organizationalUnitName_default	= $conf_EASYRSA_REQ_OU
+
+commonName			= Common Name (eg: your user, host, or server name)
+commonName_max			= 64
+commonName_default		= $conf_EASYRSA_REQ_CN
+
+emailAddress			= Email Address
+emailAddress_default		= $conf_EASYRSA_REQ_EMAIL
+emailAddress_max		= 64
+
+serialNumber		= Serial-number (eg, device serial-number)
+serialNumber_default	= $conf_EASYRSA_REQ_SERIAL
+
+####################################################################
+# Easy-RSA cert extension handling
+
+# This section is effectively unused as the main script sets extensions
+# dynamically. This core section is left to support the odd usecase where
+# a user calls openssl directly.
+[ basic_exts ]
+basicConstraints	= CA:FALSE
+subjectKeyIdentifier	= hash
+authorityKeyIdentifier	= keyid,issuer:always
+
+# The Easy-RSA CA extensions
+[ easyrsa_ca ]
+
+# PKIX recommendations:
+
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This could be marked critical, but it's nice to support reading by any
+# broken clients who attempt to do so.
+basicConstraints = CA:true
+
+# Limit key usage to CA tasks. If you really want to use the generated pair as
+# a self-signed cert, comment this out.
+keyUsage = cRLSign, keyCertSign
+
+# nsCertType omitted by default. Let's try to let the deprecated stuff die.
+# nsCertType = sslCA
+
+# A placeholder to handle the \$X509_TYPES and CA extra extensions \$EXTRA_EXTS:
+#%CA_X509_TYPES_EXTRA_EXTS%	# Do NOT remove or change this line as \$X509_TYPES and EXTRA_EXTS demands it
+
+# CRL extensions.
+[ crl_ext ]
+
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always
+CREATE_SSL_CONFIG
+		;;
+	*)
+		die "create_legacy_stream: unknown type '$1'"
+	esac
+} # => create_legacy_stream()
+
+# Version information
+print_version() {
+	ssl_version="$(
+			"${EASYRSA_OPENSSL:-openssl}" version 2>/dev/null
+		)"
+	cat <<- VERSION_TEXT
+		EasyRSA Version Information
+		Version:     $EASYRSA_version
+		Generated:   ~DATE~
+		SSL Lib:     ${ssl_version:-undefined}
+		Git Commit:  ~GITHEAD~
+		Source Repo: https://github.com/OpenVPN/easy-rsa
+		VERSION_TEXT
+} # => print_version()
 
-# variable assignment by indirection when undefined; merely exports
-# the variable when it is already defined (even if currently null)
-# Sets $1 as the value contained in $2 and exports (may be blank)
-set_var() {
-	local var=$1
-	shift
-	local value="$*"
-	eval "export $var=\"\${$var-$value}\""
-} #=> set_var()
 
 ########################################
 # Invocation entry point:
 
+EASYRSA_version="~VER~"
 NL='
 '
 
-# Be secure with a restrictive umask
-[ -z "$EASYRSA_NO_UMASK" ] && umask 077
+# Register cleanup on EXIT
+trap 'cleanup $?' EXIT
+# When SIGHUP, SIGINT, SIGQUIT, SIGABRT and SIGTERM,
+# explicitly exit to signal EXIT (non-bash shells)
+trap "exit 1" 1
+trap "exit 2" 2
+trap "exit 3" 3
+trap "exit 6" 6
+trap "exit 15" 15
+
+# Get host details - No configurable input allowed
+detect_host
+
+# Allow selective use of 'set -e'
+if [ "$EASYRSA_SET_ERREXIT" ]; then
+	set -e || die "Cannot set -e"
+	print "  # ENABLED: shell option errexit"
+fi
+
+# Protect variables from alteration by sourcing vars file
+# undocumented, not designed for use
+[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+	warn "EASYRSA_ALIAS_DAYS is not suitable for external use, resetting.."
+export EASYRSA_ALIAS_DAYS=undefined # protect from sourcing vars
+unset -v EASYRSA_FORCE_VARS # has no effect after sourcing vars
 
 # Parse options
 while :; do
+	# Reset per pass flags
+	unset -v opt val \
+		is_empty empty_ok number_only zero_allowed
+
 	# Separate option from value:
 	opt="${1%%=*}"
 	val="${1#*=}"
-	empty_ok= # Empty values are not allowed unless excepted
+
+	# Empty values are not allowed unless expected
+	# eg: '--batch'
+	[ "$opt" = "$val" ] && is_empty=1
+	# eg: '--pki-dir='
+	[ "$val" ] || is_empty=1
 
 	case "$opt" in
-	--days)
-		export EASYRSA_CERT_EXPIRE="$val"
-		export EASYRSA_CA_EXPIRE="$val"
-		export EASYRSA_CRL_DAYS="$val"
-		;;
-	--pki-dir)
-		export EASYRSA_PKI="$val" ;;
-	--use-algo)
-		export EASYRSA_ALGO="$val" ;;
-	--keysize)
-		export EASYRSA_KEY_SIZE="$val" ;;
-	--curve)
-		export EASYRSA_CURVE="$val" ;;
-	--dn-mode)
-		export EASYRSA_DN="$val" ;;
-	--req-cn)
-		export EASYRSA_REQ_CN="$val" ;;
-	--digest)
-		export EASYRSA_DIGEST="$val" ;;
-	--req-c)
-		empty_ok=1
-		export EASYRSA_REQ_COUNTRY="$val" ;;
-	--req-st)
-		empty_ok=1
-		export EASYRSA_REQ_PROVINCE="$val" ;;
-	--req-city)
-		empty_ok=1
-		export EASYRSA_REQ_CITY="$val" ;;
-	--req-org)
-		empty_ok=1
-		export EASYRSA_REQ_ORG="$val" ;;
-	--req-email)
-		empty_ok=1
-		export EASYRSA_REQ_EMAIL="$val" ;;
-	--req-ou)
-		empty_ok=1
-		export EASYRSA_REQ_OU="$val" ;;
-	--ns-cert)
-		export EASYRSA_NS_SUPPORT="$val" ;;
-	--ns-comment)
-		empty_ok=1
-		export EASYRSA_NS_COMMENT="$val" ;;
-	--batch)
-		empty_ok=1
-		export EASYRSA_BATCH=1 ;;
-	--subca-len)
-		export EASYRSA_SUBCA_LEN="$val" ;;
-	--vars)
-		export EASYRSA_VARS_FILE="$val" ;;
-	--subject-alt-name)
-		export EASYRSA_EXTRA_EXTS="\
-$EASYRSA_EXTRA_EXTS
-subjectAltName = $val" ;;
-	*)
-		break ;;
+		--days)
+			number_only=1
+			zero_allowed=1
+			# Set the appropriate date variable
+			# when called by command later
+			export EASYRSA_ALIAS_DAYS="$val"
+			;;
+		--startdate)
+			export EASYRSA_START_DATE="$val"
+			;;
+		--enddate)
+			export EASYRSA_END_DATE="$val"
+			;;
+		--pki-dir|--pki)
+			export EASYRSA_PKI="$val"
+			;;
+		--nolockfile|--no-lockfile)
+			empty_ok=1
+			export EASYRSA_NO_LOCKFILE=1
+			;;
+		--noinline|--no-inline)
+			empty_ok=1
+			export EASYRSA_NO_INLINE=1
+			;;
+		--tmp-dir)
+			export EASYRSA_TEMP_DIR="$val"
+			;;
+		--umask)
+			export EASYRSA_UMASK="$val"
+			;;
+		--noumask|--no-umask)
+			empty_ok=1
+			export EASYRSA_NO_UMASK=1
+			;;
+		--ssl-cnf|--ssl-conf)
+			export EASYRSA_SSL_CONF="$val"
+			;;
+		--keep-tmp)
+			export EASYRSA_KEEP_TEMP="$val"
+			;;
+		--algo|--use-algo)
+			export EASYRSA_ALGO="$val"
+			;;
+		--keysize)
+			number_only=1
+			export EASYRSA_KEY_SIZE="$val"
+			;;
+		--curve)
+			export EASYRSA_CURVE="$val"
+			case "$EASYRSA_CURVE" in
+				ed*) set_var EASYRSA_ALGO ed ;;
+				*) set_var EASYRSA_ALGO ec
+			esac
+			;;
+		--dn-mode)
+			export EASYRSA_DN="$val"
+			;;
+		--req-cn)
+			export EASYRSA_REQ_CN="$val"
+			;;
+		--digest)
+			export EASYRSA_DIGEST="$val"
+			;;
+		--req-c)
+			empty_ok=1
+			export EASYRSA_REQ_COUNTRY="$val"
+			;;
+		--req-st)
+			empty_ok=1
+			export EASYRSA_REQ_PROVINCE="$val"
+			;;
+		--req-city)
+			empty_ok=1
+			export EASYRSA_REQ_CITY="$val"
+			;;
+		--req-org)
+			empty_ok=1
+			export EASYRSA_REQ_ORG="$val"
+			;;
+		--req-email)
+			empty_ok=1
+			export EASYRSA_REQ_EMAIL="$val"
+			;;
+		--req-ou)
+			empty_ok=1
+			export EASYRSA_REQ_OU="$val"
+			;;
+		--req-serial)
+			empty_ok=1
+			export EASYRSA_REQ_SERIAL="$val"
+			;;
+		--ns-cert)
+			empty_ok=1
+			[ "$is_empty" ] && unset -v val
+			export EASYRSA_NS_SUPPORT="${val:-yes}"
+			;;
+		--ns-comment)
+			empty_ok=1
+			export EASYRSA_NS_COMMENT="$val"
+			;;
+		-b|--batch)
+			empty_ok=1
+			export EASYRSA_BATCH=1
+			;;
+		-s|--silent)
+			empty_ok=1
+			export EASYRSA_SILENT=1
+			;;
+		--sb|--sbatch|--silent-batch)
+			empty_ok=1
+			export EASYRSA_SILENT=1
+			export EASYRSA_BATCH=1
+			;;
+		-v|--verbose)
+			empty_ok=1
+			export EASYRSA_VERBOSE=1
+			fn_name="Easy-RSA version" verbose "$EASYRSA_version"
+			;;
+		-S|--silent-ssl)
+			empty_ok=1
+			export EASYRSA_SILENT_SSL=1
+			;;
+		--force-safe-ssl)
+			empty_ok=1
+			export EASYRSA_FORCE_SAFE_SSL=1
+			;;
+		--force-vars)
+			empty_ok=1
+			export EASYRSA_FORCE_VARS=1
+			;;
+		--nopass|--no-pass)
+			empty_ok=1
+			export EASYRSA_NO_PASS=1
+			;;
+		--passin)
+			export EASYRSA_PASSIN="$val"
+			;;
+		--passout)
+			export EASYRSA_PASSOUT="$val"
+			;;
+		--rawca|--raw-ca)
+			empty_ok=1
+			export EASYRSA_RAW_CA=1
+			;;
+		--text)
+			empty_ok=1
+			export EASYRSA_TEXT_ON=1
+			;;
+		--notext|--no-text)
+			empty_ok=1
+			export EASYRSA_TEXT_OFF=1
+			;;
+		--subca-len)
+			number_only=1
+			zero_allowed=1
+			export EASYRSA_SUBCA_LEN="$val"
+			;;
+		--vars)
+			export EASYRSA_VARS_FILE="$val"
+			;;
+		--copy-ext)
+			empty_ok=1
+			export EASYRSA_CP_EXT=1
+			;;
+		--subject-alt-name|--san)
+			# This allows --san to be used multiple times
+			if [ "$EASYRSA_SAN" ]; then
+				EASYRSA_SAN="$EASYRSA_SAN, $val"
+			else
+				EASYRSA_SAN="$val"
+			fi
+			;;
+		--auto-san)
+			empty_ok=1
+			export EASYRSA_AUTO_SAN=1
+			;;
+		--san-crit|--san-critical)
+			empty_ok=1
+			export EASYRSA_SAN_CRIT=1
+			;;
+		--bc-crit|--bc-critical)
+			empty_ok=1
+			export EASYRSA_BC_CRIT=1
+			;;
+		--ku-crit|--ku-critical)
+			empty_ok=1
+			export EASYRSA_KU_CRIT=1
+			;;
+		--eku-crit|--eku-critical)
+			empty_ok=1
+			export EASYRSA_EKU_CRIT=1
+			;;
+		--new-subj|--new-subject)
+			export EASYRSA_NEW_SUBJECT="$val"
+			;;
+		--usefn)
+			export EASYRSA_P12_FR_NAME="$val"
+			;;
+		--version)
+			shift "$#"
+			set -- "$@" "version"
+			break
+			;;
+		-h|--help|--usage)
+			shift "$#"
+			set -- "$@" "help"
+			break
+			;;
+		-*)
+			user_error "\
+Unknown option '$opt'.
+Run 'easyrsa help' for option help."
+			;;
+		*)
+			break
 	esac
 
 	# fatal error when no value was provided
-	if [ ! $empty_ok ] && { [ "$val" = "$1" ] || [ -z "$val" ]; }; then
-		die "Missing value to option: $opt"
+	if [ "$is_empty" ]; then
+		[ "$empty_ok" ] || \
+			user_error "Missing value to option: $opt"
+	fi
+
+	# fatal error when a number is expected but not provided
+	if [ "$number_only" ]; then
+		case "$val" in
+			(0)
+				# Allow zero only
+				[ "$zero_allowed" ] || \
+					user_error "$opt - Number expected: '$val'"
+				;;
+			(*[!1234567890]*|0*)
+				user_error "$opt - Number expected: '$val'"
+		esac
 	fi
 
 	shift
 done
 
-# Intelligent env-var detection and auto-loading:
-vars_setup
-
-# Register clean_temp on EXIT
-trap "clean_temp" EXIT
+# Be secure with a restrictive umask
+[ "$EASYRSA_NO_UMASK" ] || umask "${EASYRSA_UMASK:=077}"
+
+# DEPRECATED behavior - This will be removed
+# option dependencies
+# Add full --san to extra extensions
+# Do not include EASYRSA_SAN_CRIT
+# If required, an externally set SAN must include 'critical,'
+if [ "$EASYRSA_SAN" ]; then
+	EASYRSA_EXTRA_EXTS="\
+$EASYRSA_EXTRA_EXTS
+subjectAltName = $EASYRSA_SAN"
+fi
 
-# determine how we were called, then hand off to the function responsible
+# Set cmd now
 cmd="$1"
-[ -n "$1" ] && shift # scrape off command
+[ "$1" ] && shift # scrape off command
+fn_name="$cmd"
+
+# Hand off to the function responsible
+# ONLY verify_working_env() for valid commands
 case "$cmd" in
 	init-pki|clean-all)
+		export EASYRSA_NO_VARS=1 # Deliberately ignore vars
+		require_pki=""; require_ca=""; verify_working_env
 		init_pki "$@"
 		;;
 	build-ca)
+		require_pki=1; require_ca=""; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CA_EXPIRE="$EASYRSA_ALIAS_DAYS"
 		build_ca "$@"
 		;;
+	self-sign-server)
+		require_pki=1; require_ca=""; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
+		self_sign server "$@"
+		;;
+	self-sign-client)
+		require_pki=1; require_ca=""; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
+		self_sign client "$@"
+		;;
+	self*)
+		user_error "Self-sign syntax example: 'self-sign-server foo'"
+		;;
 	gen-dh)
+		require_pki=1; require_ca=""; verify_working_env
 		gen_dh
 		;;
 	gen-req)
+		require_pki=1; require_ca=""; verify_working_env
 		gen_req "$@"
 		;;
 	sign|sign-req)
+		require_pki=1; require_ca=1; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
 		sign_req "$@"
 		;;
 	build-client-full)
+		require_pki=1; require_ca=1; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
 		build_full client "$@"
 		;;
 	build-server-full)
+		require_pki=1; require_ca=1; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
 		build_full server "$@"
 		;;
+	build-serverClient-full)
+		require_pki=1; require_ca=1; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
+		build_full serverClient "$@"
+		;;
 	gen-crl)
+		require_pki=1; require_ca=1; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CRL_DAYS="$EASYRSA_ALIAS_DAYS"
 		gen_crl
 		;;
-	revoke)
-		revoke "$@"
+	revoke|revoke-issued)
+		require_pki=1; require_ca=1; verify_working_env
+		# Only move req and key if revoking an issued cert
+		# renewed certs want to keep the req/key for further renewal
+		# manually expired certs are intended to be renewed
+		revoke_move_req_and_key=1
+		revoke 'issued' "$@"
+		;;
+	revoke-expired)
+		require_pki=1; require_ca=1; verify_working_env
+		revoke_move_req_and_key=
+		revoke 'expired' "$@"
+		;;
+	revoke-renewed)
+		require_pki=1; require_ca=1; verify_working_env
+		revoke_move_req_and_key=
+		revoke 'renewed/issued' "$@"
 		;;
 	import-req)
+		require_pki=1; require_ca=""; verify_working_env
 		import_req "$@"
 		;;
+	import-ca)
+		require_pki=1; require_ca=1; verify_working_env
+		import_ca "$@"
+		;;
+	import-tls-key)
+		require_pki=1; require_ca=""; verify_working_env
+		import_tls_key "$@"
+		;;
+	expire)
+		require_pki=1; require_ca=1; verify_working_env
+		expire_cert "$@"
+		;;
+	inline)
+		require_pki=1; require_ca=""; verify_working_env
+		inline_file std "$@"
+		;;
 	export-p12)
+		require_pki=1; require_ca=""; verify_working_env
 		export_pkcs p12 "$@"
 		;;
 	export-p7)
+		require_pki=1; require_ca=""; verify_working_env
 		export_pkcs p7 "$@"
 		;;
-	set-rsa-pass)
-		set_pass rsa "$@"
+	export-p8)
+		require_pki=1; require_ca=""; verify_working_env
+		export_pkcs p8 "$@"
+		;;
+	export-p1)
+		require_pki=1; require_ca=""; verify_working_env
+		export_pkcs p1 "$@"
 		;;
-	set-ec-pass)
-		set_pass ec "$@"
+	set-pass|set-rsa-pass|set-ec-pass|set-ed-pass)
+		require_pki=1; require_ca=""; verify_working_env
+		set_pass "$@"
 		;;
 	update-db)
+		require_pki=1; require_ca=1; verify_working_env
 		update_db
 		;;
 	show-req)
+		require_pki=1; require_ca=""; verify_working_env
 		show req "$@"
 		;;
 	show-cert)
+		require_pki=1; require_ca=""; verify_working_env
 		show cert "$@"
 		;;
-	""|help|-h|--help|--usage)
+	show-crl)
+		require_pki=1; require_ca=1; verify_working_env
+		show crl crl
+		;;
+	show-ca)
+		require_pki=1; require_ca=1; verify_working_env
+		show_ca "$@"
+		;;
+	show-host)
+		require_pki=""; require_ca=""; verify_working_env
+		show_host "$@"
+		;;
+	renew-ca)
+		require_pki=1; require_ca=1; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CA_EXPIRE="$EASYRSA_ALIAS_DAYS"
+		renew_ca_cert "$@"
+		;;
+	renew)
+		require_pki=1; require_ca=1; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_CERT_EXPIRE="$EASYRSA_ALIAS_DAYS"
+		renew "$@"
+		;;
+	show-expire)
+		require_pki=1; require_ca=1; verify_working_env
+		[ -z "$EASYRSA_ALIAS_DAYS" ] || \
+			export EASYRSA_PRE_EXPIRY_WINDOW="$EASYRSA_ALIAS_DAYS"
+		status expire "$@"
+		;;
+	show-revoke)
+		require_pki=1; require_ca=1; verify_working_env
+		status revoke "$@"
+		;;
+	show-renew)
+		require_pki=1; require_ca=1; verify_working_env
+		status renew "$@"
+		;;
+	verify-cert)
+		require_pki=1; require_ca=1; verify_working_env
+		# Called with --batch, this will return error
+		# when the certificate fails verification.
+		# Therefore, on error, exit with error.
+		verify_cert "$@" || easyrsa_exit_with_error=1
+		;;
+	gen-tls-auth|gen-tls-auth-*)
+		require_pki=1; require_ca=""; verify_working_env
+		tls_key_gen tls-auth "$@"
+		;;
+	gen-tls-crypt|gen-tls-crypt-*)
+		require_pki=1; require_ca=""; verify_working_env
+		tls_key_gen tls-crypt "$@"
+		;;
+	gen-tls-cryptv2|gen-tls-cryptv2-*)
+		require_pki=1; require_ca=""; verify_working_env
+		tls_key_gen tls-crypt-v2 "$@"
+		;;
+	write)
+		# Write legacy files to write_dir
+		# or EASYRSA_PKI or EASYRSA
+		case "$1" in
+		legacy)
+			require_pki=1; require_ca=""; verify_working_env
+			# over-write NO
+			all_legacy_files_v2
+			;;
+		legacy-hard)
+			require_pki=1; require_ca=""; verify_working_env
+			# over-write YES
+			all_legacy_files_v2 overwrite
+			;;
+		*)
+			# Only allow 'type' on command line
+			# Internally, overwrite and file-name is allowed
+			require_pki=""; require_ca=""; verify_working_env
+			write_legacy_file_v2 "$1"
+		esac
+		;;
+	serial|check-serial)
+		require_pki=1; require_ca=1; verify_working_env
+		# Called with --batch, this will return error
+		# when the serial number is not unique.
+		# Therefore, on error, exit with error.
+		check_serial_unique "$@" || \
+			easyrsa_exit_with_error=1
+		;;
+	display-dn)
+		require_pki=""; require_ca=""; verify_working_env
+		display_dn "$@"
+		;;
+	x509-eku|show-eku)
+		require_pki=""; require_ca=""; verify_working_env
+		ssl_cert_x509v3_eku "$@" || \
+			easyrsa_exit_with_error=1
+		;;
+	rand|random)
+		require_pki=""; require_ca=""; verify_working_env
+		easyrsa_random "$1"
+		;;
+	help)
 		cmd_help "$1"
-		exit 0
 		;;
-	*)
-		die "Unknown command '$cmd'. Run without commands for usage help."
+	'')
+		cmd=overview
+		require_pki=""; require_ca=""; verify_working_env
+		default_overview
 		;;
+	version)
+		print_version
+		;;
+	*)
+		user_error "\
+Unknown command '$cmd'. Run without commands for usage help."
 esac
 
-# vim: ft=sh nu ai sw=8 ts=8
+# Check for untrapped errors
+# shellcheck disable=SC2181 # Quote expand - pre-cleanup $?
+if [ $? = 0 ]; then
+	# Do 'cleanup ok' on successful completion
+	verbose "COMPLETED"
+	cleanup ok
+fi
+
+# Otherwise, exit with error
+print "Untrapped error detected!"
+cleanup
+
+# vim: ft=sh nu ai sw=8 ts=8 noet
diff --git a/easyrsa3/openssl-1.0.cnf b/easyrsa3/openssl-easyrsa.cnf
similarity index 78%
rename from easyrsa3/openssl-1.0.cnf
rename to easyrsa3/openssl-easyrsa.cnf
index d9109b5a3..391bcff45 100644
--- a/easyrsa3/openssl-1.0.cnf
+++ b/easyrsa3/openssl-easyrsa.cnf
@@ -1,6 +1,4 @@
-# For use with Easy-RSA 3.0 and OpenSSL 1.0.*
-
-RANDFILE		= $ENV::EASYRSA_PKI/.rnd
+# For use with Easy-RSA 3.0+ and OpenSSL or LibreSSL
 
 ####################################################################
 [ ca ]
@@ -15,24 +13,33 @@ crl_dir		= $dir			# Where the issued crl are kept
 database	= $dir/index.txt	# database index file.
 new_certs_dir	= $dir/certs_by_serial	# default place for new certs.
 
-certificate	= $dir/ca.crt	 	# The CA certificate
-serial		= $dir/serial 		# The current serial number
-crl		= $dir/crl.pem 		# The current CRL
+certificate	= $dir/ca.crt		# The CA certificate
+serial		= $dir/serial		# The current serial number
+crl		= $dir/crl.pem		# The current CRL
 private_key	= $dir/private/ca.key	# The private key
 RANDFILE	= $dir/.rand		# private random number file
 
-x509_extensions	= basic_exts		# The extentions to add to the cert
+x509_extensions	= basic_exts		# The extensions to add to the cert
+
+# A placeholder to handle the --copy-ext feature:
+#%COPY_EXTS%	# Do NOT remove or change this line as --copy-ext support requires it
 
 # This allows a V2 CRL. Ancient browsers don't like it, but anything Easy-RSA
 # is designed for will. In return, we get the Issuer attached to CRLs.
 crl_extensions	= crl_ext
 
 default_days	= $ENV::EASYRSA_CERT_EXPIRE	# how long to certify for
-default_crl_days= $ENV::EASYRSA_CRL_DAYS	# how long before next CRL
+default_crl_days	= $ENV::EASYRSA_CRL_DAYS	# how long before next CRL
 default_md	= $ENV::EASYRSA_DIGEST		# use public key default MD
+
+# Note: preserve=no|yes, does nothing for EasyRSA.
+# Use sign-req command option 'preserve' instead.
 preserve	= no			# keep passed DN ordering
 
-# A few difference way of specifying how similar the request should look
+# This allows to renew certificates which have not been revoked
+unique_subject	= no
+
+# A few different ways of specifying how similar the request should look
 # For type CA, the listed attributes must be the same, and the optional
 # and supplied fields are just that :-)
 policy		= policy_anything
@@ -45,18 +52,18 @@ localityName		= optional
 organizationName	= optional
 organizationalUnitName	= optional
 commonName		= supplied
-name			= optional
 emailAddress		= optional
+serialNumber	= optional
 
 ####################################################################
 # Easy-RSA request handling
 # We key off $DN_MODE to determine how to format the DN
 [ req ]
 default_bits		= $ENV::EASYRSA_KEY_SIZE
-default_keyfile 	= privkey.pem
+default_keyfile	= privkey.pem
 default_md		= $ENV::EASYRSA_DIGEST
 distinguished_name	= $ENV::EASYRSA_DN
-x509_extensions		= easyrsa_ca	# The extentions to add to the self signed cert
+x509_extensions		= easyrsa_ca	# The extensions to add to the self signed cert
 
 # A placeholder to handle the $EXTRA_EXTS feature:
 #%EXTRA_EXTS%	# Do NOT remove or change this line as $EXTRA_EXTS support requires it
@@ -97,6 +104,9 @@ emailAddress			= Email Address
 emailAddress_default		= $ENV::EASYRSA_REQ_EMAIL
 emailAddress_max		= 64
 
+serialNumber		= Serial-number (eg, device serial-number)
+serialNumber_default	= $ENV::EASYRSA_REQ_SERIAL
+
 ####################################################################
 # Easy-RSA cert extension handling
 
@@ -127,6 +137,9 @@ keyUsage = cRLSign, keyCertSign
 # nsCertType omitted by default. Let's try to let the deprecated stuff die.
 # nsCertType = sslCA
 
+# A placeholder to handle the $X509_TYPES and CA extra extensions $EXTRA_EXTS:
+#%CA_X509_TYPES_EXTRA_EXTS%	# Do NOT remove or change this line as $X509_TYPES and EXTRA_EXTS demands it
+
 # CRL extensions.
 [ crl_ext ]
 
@@ -134,4 +147,3 @@ keyUsage = cRLSign, keyCertSign
 
 # issuerAltName=issuer:copy
 authorityKeyIdentifier=keyid:always,issuer:always
-
diff --git a/easyrsa3/vars.example b/easyrsa3/vars.example
index 2c444d82f..0615c4fda 100644
--- a/easyrsa3/vars.example
+++ b/easyrsa3/vars.example
@@ -1,86 +1,90 @@
 # Easy-RSA 3 parameter settings
 
-# NOTE: If you installed Easy-RSA from your distro's package manager, don't edit
+# NOTE: If you installed Easy-RSA from your package manager, do not edit
 # this file in place -- instead, you should copy the entire easy-rsa directory
-# to another location so future upgrades don't wipe out your changes.
+# to another location so future upgrades do not wipe out your changes.
 
 # HOW TO USE THIS FILE
 #
 # vars.example contains built-in examples to Easy-RSA settings. You MUST name
-# this file 'vars' if you want it to be used as a configuration file. If you do
-# not, it WILL NOT be automatically read when you call easyrsa commands.
+# this file "vars" if you want it to be used as a configuration file. If you
+# do not, it WILL NOT be automatically read when you call easyrsa commands.
 #
 # It is not necessary to use this config file unless you wish to change
-# operational defaults. These defaults should be fine for many uses without the
-# need to copy and edit the 'vars' file.
+# operational defaults. These defaults should be fine for many uses without
+# the need to copy and edit the "vars" file.
 #
 # All of the editable settings are shown commented and start with the command
-# 'set_var' -- this means any set_var command that is uncommented has been
-# modified by the user. If you're happy with a default, there is no need to
+# "set_var" -- this means any set_var command that is uncommented has been
+# modified by the user. If you are happy with a default, there is no need to
 # define the value to its default.
 
 # NOTES FOR WINDOWS USERS
 #
-# Paths for Windows  *MUST* use forward slashes, or optionally double-esscaped
-# backslashes (single forward slashes are recommended.) This means your path to
-# the openssl binary might look like this:
+# Paths for Windows  *MUST* use forward slashes, or optionally double-escaped
+# backslashes (single forward slashes are recommended.) This means your path
+# to the openssl binary might look like this:
 # "C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
 
-# A little housekeeping: DON'T EDIT THIS SECTION
-# 
-# Easy-RSA 3.x doesn't source into the environment directly.
+# A little housekeeping: DO NOT EDIT THIS SECTION
+#
+# Easy-RSA 3.x does not source into the environment directly.
 # Complain if a user tries to do this:
 if [ -z "$EASYRSA_CALLER" ]; then
-	echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
-	echo "This is no longer necessary and is disallowed. See the section called" >&2
-	echo "'How to use this file' near the top comments for more details." >&2
+	echo "You appear to be sourcing an Easy-RSA *vars* file. This is" >&2
+	echo "no longer necessary and is disallowed. See the section called" >&2
+	echo "*How to use this file* near the top comments for more details." >&2
 	return 1
 fi
 
 # DO YOUR EDITS BELOW THIS POINT
 
-# This variable should point to the top level of the easy-rsa tree. By default,
-# this is taken to be the directory you are currently in.
-
-#set_var EASYRSA	"$PWD"
+# This variable is used as the base location of configuration files needed by
+# easyrsa.  More specific variables for specific files (eg: EASYRSA_SSL_CONF)
+# may override this default.
+#
+# The default value of this variable is the location of the easyrsa script
+# itself, which is also where the configuration files are located in the
+# easy-rsa tree.
+#
+#set_var EASYRSA	"${0%/*}"
 
-# If your OpenSSL command is not in the system PATH, you will need to define the
-# path to it here. Normally this means a full path to the executable, otherwise
+# If your OpenSSL command is not in the system PATH, you will need to define
+# the path here. Normally this means a full path to the executable, otherwise
 # you could have left it undefined here and the shown default would be used.
 #
 # Windows users, remember to use paths with forward-slashes (or escaped
 # back-slashes.) Windows users should declare the full path to the openssl
 # binary here if it is not in their system PATH.
-
+#
 #set_var EASYRSA_OPENSSL	"openssl"
 #
 # This sample is in Windows syntax -- edit it for your path if not using PATH:
 #set_var EASYRSA_OPENSSL	"C:/Program Files/OpenSSL-Win32/bin/openssl.exe"
 
-# Edit this variable to point to your soon-to-be-created key directory.
-#
-# WARNING: init-pki will do a rm -rf on this directory so make sure you define
-# it correctly! (Interactive mode will prompt before acting.)
-
-#set_var EASYRSA_PKI		"$EASYRSA/pki"
-
 # Define X509 DN mode.
-# This is used to adjust what elements are included in the Subject field as the DN
-# (this is the "Distinguished Name.")
-# Note that in cn_only mode the Organizational fields further below aren't used.
+#
+# This is used to adjust which elements are included in the Subject field
+# as the DN ("Distinguished Name"). Note that in 'cn_only' mode the
+# Organizational fields, listed further below, are not used.
 #
 # Choices are:
-#   cn_only  - use just a CN value
-#   org      - use the "traditional" Country/Province/City/Org/OU/email/CN format
-
+#   cn_only  - Use just a commonName value.
+#   org      - Use the "traditional" format:
+#              Country/Province/City/Org/Org.Unit/email/commonName
+#
 #set_var EASYRSA_DN	"cn_only"
 
-# Organizational fields (used with 'org' mode and ignored in 'cn_only' mode.)
+# Organizational fields (used with "org" mode and ignored in "cn_only" mode).
 # These are the default values for fields which will be placed in the
-# certificate.  Don't leave any of these fields blank, although interactively
+# certificate.  Do not leave any of these fields blank, although interactively
 # you may omit any specific field by typing the "." symbol (not valid for
-# email.)
-
+# email).
+#
+# NOTE: The following characters are not supported
+#       in these "Organizational fields" by Easy-RSA:
+#       back-tick (`)
+#
 #set_var EASYRSA_REQ_COUNTRY	"US"
 #set_var EASYRSA_REQ_PROVINCE	"California"
 #set_var EASYRSA_REQ_CITY	"San Francisco"
@@ -88,12 +92,25 @@ fi
 #set_var EASYRSA_REQ_EMAIL	"me@example.net"
 #set_var EASYRSA_REQ_OU		"My Organizational Unit"
 
-# Choose a size in bits for your keypairs. The recommended value is 2048.  Using
-# 2048-bit keys is considered more than sufficient for many years into the
-# future. Larger keysizes will slow down TLS negotiation and make key/DH param
-# generation take much longer. Values up to 4096 should be accepted by most
-# software. Only used when the crypto alg is rsa (see below.)
+# Preserve the Distinguished Name field order
+# of the certificate signing request
+# *Only* effective in --dn-mode=org
+#
+#set_var EASYRSA_PRESERVE_DN	1
 
+# Set no password mode - This will create the entire PKI without passwords.
+# This can be better managed by choosing which entity private keys should be
+# encrypted with the following command line options:
+# Global option '--no-pass' or command option 'nopass'.
+#
+#set_var EASYRSA_NO_PASS	1
+
+# Choose a size in bits for your keypairs. The recommended value is 2048.
+# Using 2048-bit keys is considered more than sufficient for many years into
+# the future. Larger keysizes will slow down TLS negotiation and make key/DH
+# param generation take much longer. Values up to 4096 should be accepted by
+# most software. Only used when the crypto alg is rsa, see below.
+#
 #set_var EASYRSA_KEY_SIZE	2048
 
 # The default crypto mode is rsa; ec can enable elliptic curve support.
@@ -101,49 +118,70 @@ fi
 # Choices for crypto alg are: (each in lower-case)
 #  * rsa
 #  * ec
-
+#  * ed
+#
 #set_var EASYRSA_ALGO		rsa
 
-# Define the named curve, used in ec mode only:
-
+# Define the named curve, used in ec & ed modes:
+#
 #set_var EASYRSA_CURVE		secp384r1
 
 # In how many days should the root CA key expire?
-
+#
 #set_var EASYRSA_CA_EXPIRE	3650
 
 # In how many days should certificates expire?
+#
+#set_var EASYRSA_CERT_EXPIRE	825
 
-#set_var EASYRSA_CERT_EXPIRE	3650
+# How many days until the Certificate Revokation List will expire.
+#
+# IMPORTANT: When the CRL expires, an OpenVPN Server which uses a
+# CRL will reject ALL new connections, until the CRL is replaced.
+#
+#set_var EASYRSA_CRL_DAYS	180
 
-# How many days until the next CRL publish date?  Note that the CRL can still be
-# parsed after this timeframe passes. It is only used for an expected next
-# publication date.
+# Random serial numbers by default.
+# Set to 'no' for the old incremental serial numbers.
+#
+#set_var EASYRSA_RAND_SN	"yes"
 
-#set_var EASYRSA_CRL_DAYS	180
+# Cut-off window for checking expiring certificates.
+#
+#set_var EASYRSA_PRE_EXPIRY_WINDOW	90
 
-# Support deprecated "Netscape" extensions? (choices "yes" or "no".) The default
-# is "no" to discourage use of deprecated extensions. If you require this
-# feature to use with --ns-cert-type, set this to "yes" here. This support
-# should be replaced with the more modern --remote-cert-tls feature.  If you do
-# not use --ns-cert-type in your configs, it is safe (and recommended) to leave
-# this defined to "no".  When set to "yes", server-signed certs get the
-# nsCertType=server attribute, and also get any NS_COMMENT defined below in the
-# nsComment field.
+# Generate automatic subjectAltName for certificates
+#
+#set_var	EASYRSA_AUTO_SAN	1
 
+# Add critical attribute to X509 fields: basicConstraints (BC),
+# keyUsage (KU), extendedKeyUsage (EKU) or SAN
+#
+#set_var	EASYRSA_BC_CRIT		1
+#set_var	EASYRSA_KU_CRIT		1
+#set_var	EASYRSA_EKU_CRIT	1
+#set_var	EASYRSA_SAN_CRIT	1
+
+# Disable automatic inline files
+#
+#set_var	EASYRSA_NO_INLINE	1
+
+# Support deprecated "Netscape" extensions? (choices "yes" or "no").
+# The default is "no", to discourage use of deprecated extensions.
+# If you require this feature to use with --ns-cert-type, set this to "yes".
+# This support should be replaced with the more modern --remote-cert-tls
+# feature.  If you do not use --ns-cert-type in your configs, it is safe,
+# and recommended, to leave this defined to "no".
+# When set to "yes", server-signed certs get the nsCertType=server attribute
+# and also get any NS_COMMENT defined below in the nsComment field.
+#
 #set_var EASYRSA_NS_SUPPORT	"no"
 
 # When NS_SUPPORT is set to "yes", this field is added as the nsComment field.
 # Set this blank to omit it. With NS_SUPPORT set to "no" this field is ignored.
-
+#
 #set_var EASYRSA_NS_COMMENT	"Easy-RSA Generated Certificate"
 
-# A temp file used to stage cert extensions during signing. The default should
-# be fine for most users; however, some users might want an alternative under a
-# RAM-based FS, such as /dev/shm or /tmp on some systems.
-
-#set_var EASYRSA_TEMP_FILE	"$EASYRSA_PKI/extensions.temp"
-
 # !!
 # NOTE: ADVANCED OPTIONS BELOW THIS POINT
 # PLAY WITH THEM AT YOUR OWN RISK
@@ -152,9 +190,9 @@ fi
 # Broken shell command aliases: If you have a largely broken shell that is
 # missing any of these POSIX-required commands used by Easy-RSA, you will need
 # to define an alias to the proper path for the command.  The symptom will be
-# some form of a 'command not found' error from your shell. This means your
+# some form of a "command not found" error from your shell. This means your
 # shell is BROKEN, but you can hack around it here if you really need. These
-# shown values are not defaults: it is up to you to know what you're doing if
+# shown values are not defaults: it is up to you to know what you are doing if
 # you touch these.
 #
 #alias awk="/alt/bin/awk"
@@ -163,37 +201,35 @@ fi
 # X509 extensions directory:
 # If you want to customize the X509 extensions used, set the directory to look
 # for extensions here. Each cert type you sign must have a matching filename,
-# and an optional file named 'COMMON' is included first when present. Note that
+# and an optional file named "COMMON" is included first when present. Note that
 # when undefined here, default behaviour is to look in $EASYRSA_PKI first, then
-# fallback to $EASYRSA for the 'x509-types' dir.  You may override this
+# fallback to $EASYRSA for the "x509-types" dir.  You may override this
 # detection with an explicit dir here.
 #
 #set_var EASYRSA_EXT_DIR	"$EASYRSA/x509-types"
 
+# Non-functional
+# If you want to generate KDC certificates, you need to set the realm here.
+#
+#set_var EASYRSA_KDC_REALM      "CHANGEME.EXAMPLE.COM"
+
 # OpenSSL config file:
 # If you need to use a specific openssl config file, you can reference it here.
-# Normally this file is auto-detected from a file named openssl-1.0.cnf from the
-# EASYRSA_PKI or EASYRSA dir (in that order.) NOTE that this file is Easy-RSA
-# specific and you cannot just use a standard config file, so this is an
-# advanced feature.
-
-#set_var EASYRSA_SSL_CONF	"$EASYRSA/openssl-1.0.cnf"
-
-# Default CN:
-# This is best left alone. Interactively you will set this manually, and BATCH
-# callers are expected to set this themselves.
-
-#set_var EASYRSA_REQ_CN		"ChangeMe"
+# Normally this file is auto-detected from a file named openssl-easyrsa.cnf
+# from the EASYRSA_PKI or EASYRSA dir, in that order. NOTE that this file is
+# Easy-RSA specific and you cannot just use a standard config file, so this is
+# an advanced feature.
+#
+#set_var EASYRSA_SSL_CONF	"$EASYRSA_PKI/openssl-easyrsa.cnf"
 
 # Cryptographic digest to use.
 # Do not change this default unless you understand the security implications.
 # Valid choices include: md5, sha1, sha256, sha224, sha384, sha512
-
+#
 #set_var EASYRSA_DIGEST		"sha256"
 
 # Batch mode. Leave this disabled unless you intend to call Easy-RSA explicitly
 # in batch mode without any user input, confirmation on dangerous operations,
 # or most output. Setting this to any non-blank string enables batch mode.
-
+#
 #set_var EASYRSA_BATCH		""
-
diff --git a/easyrsa3/x509-types/COMMON b/easyrsa3/x509-types/COMMON
index 3e9b633f4..a9867dbb3 100644
--- a/easyrsa3/x509-types/COMMON
+++ b/easyrsa3/x509-types/COMMON
@@ -5,3 +5,8 @@
 # demonstrated in the following example:
 
 #crlDistributionPoints = URI:http://example.net/pki/my_ca.crl
+
+# The authority information access extension gives details about how to access
+# certain information relating to the CA.
+
+#authorityInfoAccess = caIssuers;URI:http://example.net/pki/my_ca.crt
diff --git a/easyrsa3/x509-types/ca b/easyrsa3/x509-types/ca
index ef525b6f0..d0f87d8c3 100644
--- a/easyrsa3/x509-types/ca
+++ b/easyrsa3/x509-types/ca
@@ -6,8 +6,7 @@
 #
 # basicConstraints = CA:TRUE, pathlen:1
 
-basicConstraints = CA:TRUE
+basicConstraints = critical,CA:TRUE
 subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid:always,issuer:always
 keyUsage = cRLSign, keyCertSign
-
diff --git a/easyrsa3/x509-types/client b/easyrsa3/x509-types/client
index a7d81af4e..aed0065de 100644
--- a/easyrsa3/x509-types/client
+++ b/easyrsa3/x509-types/client
@@ -5,4 +5,3 @@ subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid,issuer:always
 extendedKeyUsage = clientAuth
 keyUsage = digitalSignature
-
diff --git a/easyrsa3/x509-types/code-signing b/easyrsa3/x509-types/code-signing
new file mode 100644
index 000000000..9a2115ba0
--- /dev/null
+++ b/easyrsa3/x509-types/code-signing
@@ -0,0 +1,7 @@
+# X509 extensions for a client
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = codeSigning
+keyUsage = digitalSignature
diff --git a/easyrsa3/x509-types/email b/easyrsa3/x509-types/email
new file mode 100644
index 000000000..bc8f39e0b
--- /dev/null
+++ b/easyrsa3/x509-types/email
@@ -0,0 +1,7 @@
+# X509 extensions for email
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = emailProtection
+keyUsage = digitalSignature,keyEncipherment,nonRepudiation
diff --git a/easyrsa3/x509-types/kdc b/easyrsa3/x509-types/kdc
new file mode 100644
index 000000000..581100d3b
--- /dev/null
+++ b/easyrsa3/x509-types/kdc
@@ -0,0 +1,22 @@
+# Easy-RSA does NOT explicitly support X509 type 'KDC'
+# X509 extensions for a KDC server certificate
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = 1.3.6.1.5.2.3.5
+keyUsage = nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
+issuerAltName = issuer:copy
+subjectAltName = otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
+
+[kdc_princ_name]
+realm = EXP:0,GeneralString:${ENV::EASYRSA_KDC_REALM}
+principal_name = EXP:1,SEQUENCE:kdc_principal_seq
+
+[kdc_principal_seq]
+name_type = EXP:0,INTEGER:1
+name_string = EXP:1,SEQUENCE:kdc_principals
+
+[kdc_principals]
+princ1 = GeneralString:krbtgt
+princ2 = GeneralString:${ENV::EASYRSA_KDC_REALM}
diff --git a/easyrsa3/x509-types/server b/easyrsa3/x509-types/server
index bc024be57..8c4d5370a 100644
--- a/easyrsa3/x509-types/server
+++ b/easyrsa3/x509-types/server
@@ -5,4 +5,3 @@ subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid,issuer:always
 extendedKeyUsage = serverAuth
 keyUsage = digitalSignature,keyEncipherment
-
diff --git a/easyrsa3/x509-types/serverClient b/easyrsa3/x509-types/serverClient
new file mode 100644
index 000000000..8a8a58ed9
--- /dev/null
+++ b/easyrsa3/x509-types/serverClient
@@ -0,0 +1,7 @@
+# X509 extensions for a client/server
+
+basicConstraints = CA:FALSE
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid,issuer:always
+extendedKeyUsage = serverAuth,clientAuth
+keyUsage = digitalSignature,keyEncipherment
diff --git a/op-test.sh b/op-test.sh
new file mode 100644
index 000000000..0f2fe60cf
--- /dev/null
+++ b/op-test.sh
@@ -0,0 +1,472 @@
+#!/bin/sh
+#
+# Downloads the run_unit_tests.sh file from easyrsa-unit-tests repo
+# and executes that - allows for disconnected testing from the easy-rsa
+# repo with TravisCI.
+
+# log
+log () {
+	[ "$disable_log" ] && return
+	if printf '%s\n' "* $*"; then
+		return
+	else
+		echo "printf failed"
+		exit 9
+	fi
+} # => log ()
+
+# clean up
+clean_up () {
+	if [ "$no_delete" ]; then
+		log "saved final state.."
+	else
+		log "op-test: clean_up"
+		if [ "$EASYRSA_NIX" ]; then
+			[ "$keep_eut" ] || rm -f "$utest_bin"
+			[ "$keep_sc" ] || rm -f "$sc_bin"
+			[ "$keep_ssl" ] || rm -f "$ssl_bin"
+		fi
+	fi
+} # => clean_up ()
+
+# curl download and openssl hash
+# wing it ..
+curl_it () {
+	#log "BEGIN: curl_it"
+	if [ "$#" -eq 2 ]; then
+		file="$1"
+		hash="$2"
+	else
+		log "> Usage: <file> <hash>"
+		return 1
+	fi
+
+	if [ "$enable_curl" ]; then
+		: # ok
+	else
+		log "> curl disabled"
+		return 0
+	fi
+
+	# valid target
+	case "$file" in
+	easyrsa-unit-tests.sh|easyrsa-unit-tests-help.sh)
+		unset -v require_hash
+	;;
+	shellcheck|openssl)
+		require_hash=1
+	;;
+	*)
+		log "> invalid target: $file"
+		return 1
+	esac
+
+	# download
+	if [ "$enable_curl" ]; then
+		log "> download: ${gh_url}/${file}"
+		curl -SO "${gh_url}/${file}" || \
+			log "> download failed: ${file}"
+	else
+		log "> curl disabled"
+	fi
+
+	# hash download
+	if [ "${require_hash}" ]; then
+		if [ -e "${file}" ]; then
+			log "> hash ${file}"
+			temp_hash="$(openssl sha256 "${file}")"
+			#log "temp_hash: $temp_hash"
+			#log "hash     : $hash"
+			if [ "$temp_hash" = "$hash" ]; then
+				: # OK - hash is good
+			else
+				log "> hash failed: ${file}"
+				return 1
+			fi
+		else
+			log "> file missing: ${file}"
+			return 1
+		fi
+	else
+		if [ -e "${file}" ]; then
+			: # ok - file is here
+		else
+			log "> file missing: ${file}"
+			return 1
+		fi
+	fi
+} # => curl_it ()
+
+################################################################################
+
+# RUN unit test
+run_unit_test ()
+{
+	if [ "${utest_bin_ok}" ]; then
+
+		# Start unit tests
+		log ">>> BEGIN unit tests:"
+		[ "$no_delete" ] && export SAVE_PKI=1
+
+		if [ "${dry_run}" ]; then
+			log "<<dry-run>> sh ${utest_bin} ${verb} $use_passwords"
+			estat=1
+		else
+			log ">>>>>>: sh ${utest_bin} ${verb}"
+			if sh "${utest_bin}" "${verb}" "$use_passwords"; then
+				log "OK"
+				estat=0
+				if [ "$EASYRSA_BY_TINCANTECH" ]; then
+					sh "${utest_help_bin}" "${help_verb}" "$use_passwords"
+				fi
+			else
+				log "FAIL"
+				estat=1
+			fi
+		fi
+		log "<<< END unit tests:"
+		unset SAVE_PKI
+	else
+		log "unit-test abandoned"
+		estat=1
+	fi
+} # => run_unit_test ()
+
+########################################
+
+## DOWNLOAD unit-test
+download_unit_test () {
+	# if not present then download unit-test
+	target_file="${utest_file}"
+	target_hash="${utest_hash}"
+	if [ "$enable_unit_test" ]; then
+		if [ -e "${ERSA_UT}/${target_file}" ]; then
+			[ -x "${ERSA_UT}/${target_file}" ] || \
+				chmod +x "${ERSA_UT}/${target_file}"
+			# version check
+			if "${ERSA_UT}/${target_file}" version; then
+				utest_bin="${ERSA_UT}/${target_file}"
+				utest_bin_ok=1
+				export ERSA_UTEST_CURL_TARGET=localhost
+			else
+				log "version check failed: ${ERSA_UT}/${target_file}"
+			fi
+		else
+			# download and basic check
+			log "curl_it ${target_file}"
+			if curl_it "${target_file}" "${target_hash}"; then
+				[ -x "${ERSA_UT}/${target_file}" ] || \
+					chmod +x "${ERSA_UT}/${target_file}"
+				# functional check - version check
+				if "${ERSA_UT}/${target_file}" version; then
+					utest_bin="${ERSA_UT}/${target_file}"
+					utest_bin_ok=1
+					export ERSA_UTEST_CURL_TARGET=online
+					unset -v keep_eut
+				else
+					log "version check failed: ${target_file}"
+				fi
+			else
+				log "curl_it ${target_file} - failed"
+			fi
+		fi
+		[ "$utest_bin_ok" ] || log "undefined: utest_bin_ok"
+		log "setup unit-test - ok"
+	else
+		log "unit-test disabled"
+	fi # => shellcheck
+}
+## DOWNLOAD unit-test
+
+## DOWNLOAD unit-test-help
+download_unit_test_help () {
+	# if not present then download unit-test-help
+	target_file="${utest_help_file}"
+	target_hash="${utest_hash}"
+	if [ "$enable_unit_test" ]; then
+		if [ -e "${ERSA_UT}/${target_file}" ]; then
+			[ -x "${ERSA_UT}/${target_file}" ] || \
+				chmod +x "${ERSA_UT}/${target_file}"
+			# version check
+			if "${ERSA_UT}/${target_file}" version; then
+				utest_help_bin="${ERSA_UT}/${target_file}"
+				utest_help_bin_ok=1
+				export ERSA_UTEST_CURL_TARGET=localhost
+			else
+				log "version check failed: ${ERSA_UT}/${target_file}"
+			fi
+		else
+			# download and basic check
+			log "curl_it ${target_file}"
+			if curl_it "${target_file}" "${target_hash}"; then
+				[ -x "${ERSA_UT}/${target_file}" ] || \
+					chmod +x "${ERSA_UT}/${target_file}"
+				# functional check - version check
+				if "${ERSA_UT}/${target_file}" version; then
+					utest_help_bin="${ERSA_UT}/${target_file}"
+					utest_help_bin_ok=1
+					export ERSA_UTEST_CURL_TARGET=online
+					unset -v keep_eut
+				else
+					log "version check failed: ${target_file}"
+				fi
+			else
+				log "curl_it ${target_file} - failed"
+			fi
+		fi
+		[ "$utest_help_bin_ok" ] || log "undefined: utest_help_bin_ok"
+		log "setup unit-test-help - ok"
+	else
+		log "unit-test-help disabled"
+	fi # => shellcheck
+}
+## DOWNLOAD unit-test-help
+
+################################################################################
+
+## USE shellcheck
+
+# Run shellcheck
+run_shellcheck () {
+	sc_bin=shellcheck
+	if [ "$enable_shellcheck" ] && [ "$EASYRSA_NIX" ]; then
+		# shell-check easyrsa3/easyrsa
+		if [ -e easyrsa3/easyrsa ]; then
+			if "${sc_bin}" -s sh -S warning -x easyrsa3/easyrsa; then
+				log "shellcheck easyrsa3/easyrsa completed - ok"
+			else
+				log "shellcheck easyrsa3/easyrsa completed - FAILED"
+			fi
+		else
+			log "easyrsa binary not present, not using shellcheck"
+		fi
+
+		# shell-check dev/easyrsa-tools.lib
+		if [ -e dev/easyrsa-tools.lib ]; then
+			if "${sc_bin}" -s sh -S warning -x dev/easyrsa-tools.lib; then
+				log "shellcheck dev/easyrsa-tools.lib completed - ok"
+			else
+				log "shellcheck dev/easyrsa-tools.lib completed - FAILED"
+			fi
+		else
+			log "dev/easyrsa-tools.lib not present, not using shellcheck"
+		fi
+
+		# shell-check easyrsa-unit-tests.sh
+		if [ -e easyrsa-unit-tests.sh ]; then
+			if "${sc_bin}" -s sh -S warning -x easyrsa-unit-tests.sh; then
+				log "shellcheck easyrsa-unit-tests.sh completed - ok"
+			else
+				log "shellcheck easyrsa-unit-tests.sh completed - FAILED"
+			fi
+		else
+			log "easyrsa-unit-tests.sh binary not present, not using shellcheck"
+		fi
+	else
+		log "shellcheck abandoned"
+	fi
+}
+## USE shellcheck
+
+########################################
+
+## DOWNLOAD shellcheck
+download_shellcheck () {
+	# if not present then download shellcheck
+	target_file="${sc_file}"
+	target_hash="${sc_hash}"
+	if [ "$enable_shellcheck" ] && [ "$EASYRSA_NIX" ]; then
+		log "setup shellcheck"
+		if [ -e "${ERSA_UT}/${target_file}" ]; then
+			[ -x "${ERSA_UT}/${target_file}" ] || \
+				chmod +x "${ERSA_UT}/${target_file}"
+			"${ERSA_UT}/${target_file}" -V || \
+				log "version check failed: ${ERSA_UT}/${target_file}"
+			sc_bin="${ERSA_UT}/${target_file}"
+			sc_bin_ok=1
+			log "shellcheck enabled"
+		else
+			# download and basic check
+			log "curl_it ${target_file}"
+			if curl_it "${target_file}" "${target_hash}"; then
+				log "curl_it ${target_file} - ok"
+				[ -x "${ERSA_UT}/${target_file}" ] || \
+					chmod +x "${ERSA_UT}/${target_file}"
+				# functional check
+				if "${ERSA_UT}/${target_file}" -V; then
+					sc_bin="${ERSA_UT}/${target_file}"
+					sc_bin_ok=1
+					unset -v keep_sc
+				else
+					log "version check failed: ${ERSA_UT}/${target_file}"
+				fi
+				log "shellcheck enabled"
+			else
+				log "curl_it ${target_file} - failed"
+			fi
+		fi
+	fi
+
+	## DOWNLOAD shellcheck
+}
+
+################################################################################
+
+## DOWNLOAD openssl-3
+download_opensslv3 () {
+	# if not present then download and then use openssl3
+	target_file="${ssl_file}"
+	target_hash="${ssl_hash}"
+	if [ "$enable_openssl3" ] && [ "$EASYRSA_NIX" ]; then
+		if [ -e "${ERSA_UT}/${target_file}" ]; then
+			[ -x "${ERSA_UT}/${target_file}" ] || \
+				chmod +x "${ERSA_UT}/${target_file}"
+			# version check 'openssl version'
+			"${ERSA_UT}/${target_file}" version || \
+				log "version check failed: ${ERSA_UT}/${target_file}"
+			ssl_bin="${ERSA_UT}/${target_file}"
+			ssl_bin_ok=1
+			# Set up Easy-RSA Unit-Test for OpenSSL-v3
+			export EASYRSA_OPENSSL="${ssl_bin}"
+		else
+			# download and basic check
+			log "curl_it ${target_file}"
+			if curl_it "${target_file}" "${target_hash}"; then
+				log "curl_it ${target_file} - ok"
+				[ -x "${ERSA_UT}/${target_file}" ] || \
+					chmod +x "${ERSA_UT}/${target_file}"
+				# functional check - version check 'openssl version'
+				if "${ERSA_UT}/${target_file}" version; then
+					ssl_bin="${ERSA_UT}/${target_file}"
+					ssl_bin_ok=1
+					unset -v keep_ssl
+					# Set up Easy-RSA Unit-Test for OpenSSL-v3
+					export EASYRSA_OPENSSL="${ssl_bin}"
+				else
+					log "version check failed: ${ERSA_UT}/${target_file}"
+				fi
+			else
+				log "curl_it ${target_file} - failed"
+			fi
+		fi
+
+			log "OpenSSL-v3 enabled"
+
+	else
+		if [ "$EASYRSA_NIX" ]; then
+			log "System SSL enabled"
+			ssl_bin="openssl"
+			ssl_bin_ok=1
+		else
+			log "Windows, no OpenSSL-v3"
+			log "System SSL enabled"
+			ssl_bin="openssl"
+			ssl_bin_ok=1
+		fi
+	fi
+} # => ## DOWNLOAD openssl-3
+
+################################################################################
+
+	# Register clean_up on EXIT
+	#trap "exited 0" 0
+	# When SIGHUP, SIGINT, SIGQUIT, SIGABRT and SIGTERM,
+	# explicitly exit to signal EXIT (non-bash shells)
+	trap "clean_up" 1
+	trap "clean_up" 2
+	trap "clean_up" 3
+	trap "clean_up" 6
+	trap "clean_up" 15
+
+
+unset -v disable_log verb no_delete \
+		enable_unit_test enable_shellcheck enable_openssl3
+
+keep_sc=1
+keep_ssl=1
+keep_eut=1
+
+# Set by default
+enable_unit_test=1
+enable_curl=1
+EASYRSA_NIX=1
+
+while [ -n "$1" ]; do
+	case "$1" in
+	--no-log)			disable_log=1 ;;
+	'')					verb='-v' ;;
+	-v)					verb='-v' ;;
+	-vv)				verb='-vv' ;;
+	-sc)				enable_shellcheck=1 ;;
+	-o3)				: ;; # ignored
+	-p)					use_passwords='-p' ;;
+	-dr)				dry_run=1 ;;
+	-nt|--no-test)		unset -v enable_unit_test ;;
+	-nc|--no-curl)		unset -v enable_curl ;;
+	-nd|--no-delete)	no_delete=1 ;;
+	-w|--windows)		export EASYRSA_WIN=1; unset -v EASYRSA_NIX ;;
+	*)
+		log "Unknown option: $1"
+		exit 9
+	esac
+	shift
+done
+
+log "Easy-RSA Unit Tests:"
+
+# Layout
+ERSA_UT="${PWD}"
+
+# Sources
+gh_url='https://raw.githubusercontent.com/OpenVPN/easyrsa-unit-tests/master'
+
+utest_file='easyrsa-unit-tests.sh'
+unset -v utest_bin utest_bin_ok
+utest_hash='no-hash'
+
+utest_help_file='easyrsa-unit-tests-help.sh'
+unset -v utest_help_bin utest_help_bin_ok
+#utest_hash='no-hash'
+help_verb="-vv"
+
+sc_file='shellcheck'
+unset -v sc_bin sc_bin_ok
+# v 0.8.0
+#sc_hash='SHA256(shellcheck)= f4bce23c11c3919c1b20bcb0f206f6b44c44e26f2bc95f8aa708716095fa0651'
+
+# v 0.9.0
+sc_hash='SHA256(shellcheck)= 7087178d54de6652b404c306233264463cb9e7a9afeb259bb663cc4dbfd64149'
+
+ssl_file='openssl'
+unset -v ssl_bin ssl_bin_ok
+# v 3.0.3
+#ssl_hash='SHA256(openssl)= a0aed8b4aec1b72ca17c8a9ab04e10d829343a12cb5e7f8f6ae73e6f2ce026fd'
+
+# v 3.0.5
+#ssl_hash='SHA256(openssl)= 341d278423aeecbaa2b057b84b5501dd492c8f7e192c5bb9c66a260dbc022a4c'
+
+# v 3.0.7
+#ssl_hash='SHA256(openssl)= 606f8fb9d6ac7993c2f68efba8c4f022e128a8e9ab1a0921e4941d9f88a7bb5b'
+
+# v 3.1.0
+ssl_hash='SHA256(openssl)= 85b562891087d4c64868d8d1f0a381407d8e23fb66c37ce9baad55cf57edbc04'
+
+# Here we go ..
+
+#download_shellcheck
+#download_opensslv3
+download_unit_test
+download_unit_test_help
+
+run_shellcheck
+run_unit_test
+
+# No trap required..
+clean_up
+
+################################################################################
+
+log "estat: $estat ${dry_run:+<<dry run>>}"
+exit $estat
+
+# vim: no
diff --git a/release-keys/README.md b/release-keys/README.md
index c92881d07..524111a0b 100644
--- a/release-keys/README.md
+++ b/release-keys/README.md
@@ -10,11 +10,7 @@ Current keys
 
 These keys are currently valid:
 
-* Key ID 0x606FD463
-  * Owner: Josh Cepek <josh.cepek@usa.net>
-  * Key fingerprint: 65FF 3F24 AA08 E882 CB44  4C94 D731 D97A 606F D463
-
-* Key ID 0x9D7367F3
+* Key ID [0x9D7367F3](https://keys.openpgp.org/vks/v1/by-fingerprint/6F4056821152F03B6B24F2FCF8489F839D7367F3)
   * Owner: Eric Crist <ecrist@secure-computing.net>
   * Key fingerprint: 6F40 5682 1152 F03B 6B24  F2FC F848 9F83 9D73 67F3
 
@@ -23,4 +19,17 @@ Former keys
 
 These keys were once valid but are now expired or revoked:
 
-* None, currently
+* Key ID 0x606FD463
+  * Owner: Josh Cepek <josh.cepek@usa.net>
+  * Key fingerprint: 65FF 3F24 AA08 E882 CB44  4C94 D731 D97A 606F D463
+  * Member is no longer active with EasyRSA.
+
+Verifying Signatures
+===
+You can verify the signatures provided by downloading the public key for the current key (above) and adding it to your keychain. Then you can verify with the following command:
+```
+ecrist@marvin:~/Downloads-> gpg --verify EasyRSA-3.0.8.tgz.sig EasyRSA-3.0.8.tgz
+gpg: Signature made Wed Sep  9 16:00:35 2020 CDT
+gpg:                using RSA key C8FCA3E7F787072CDEB91D2F72964219390D0D0E
+gpg: Good signature from "Eric F Crist <ecrist@secure-computing.net>"
+```
diff --git a/wop-test.bat b/wop-test.bat
new file mode 100644
index 000000000..220ee4f6d
--- /dev/null
+++ b/wop-test.bat
@@ -0,0 +1,37 @@
+@echo off
+
+IF "%1"=="/SL" (set SAVE_LAYOUT=1) ELSE set SAVE_LAYOUT=0
+
+set SYS_ARCH=test
+IF %PROCESSOR_ARCHITECTURE%==x86 set SYS_ARCH=win32
+IF %PROCESSOR_ARCHITECTURE%==x86_64 set SYS_ARCH=win64
+IF %PROCESSOR_ARCHITECTURE%==AMD64 set SYS_ARCH=win64
+IF %SYS_ARCH%==test (
+	echo Fatal Error: Unknown PROCESSOR_ARCHITECTURE
+	set SYS_ARCH=
+	exit /B 1 )
+
+set WORK_DIR=%cd%
+mkdir "%WORK_DIR%\easyrsa3\bin"
+copy  "%WORK_DIR%\distro\windows\bin\*" "%WORK_DIR%\easyrsa3\bin"
+copy  "%WORK_DIR%\distro\windows\%SYS_ARCH%\*" "%WORK_DIR%\easyrsa3\bin"
+copy  "%WORK_DIR%\distro\windows\EasyRSA-Start.bat" "%WORK_DIR%\easyrsa3\EasyRSA-Start.bat"
+PATH=%PATH%;%WORK_DIR%\easyrsa3\bin;C:\PROGRA~1\openssl
+
+cmd /C "easyrsa3\bin\sh.exe wop-test.sh"
+IF ERRORLEVEL 1 (
+	echo Error occurred, Exit 1
+	exit /B 1 )
+
+REM Success ..
+	IF %SAVE_LAYOUT% EQU 0 (
+		echo rmdir /S /Q "%WORK_DIR%\easyrsa3\bin"
+		rmdir /S /Q "%WORK_DIR%\easyrsa3\bin"
+		echo del /Q "%WORK_DIR%\easyrsa3\EasyRSA-Start.bat"
+		del /Q "%WORK_DIR%\easyrsa3\EasyRSA-Start.bat"
+		REM echo del "%WORK_DIR%\easyrsa3\.rnd"
+		REM del /Q "%WORK_DIR%\easyrsa3\.rnd"
+	) ELSE echo NOTICE; Saved Layout
+
+set SAVE_LAYOUT=
+set SYS_ARCH=
diff --git a/wop-test.sh b/wop-test.sh
new file mode 100644
index 000000000..99919088b
--- /dev/null
+++ b/wop-test.sh
@@ -0,0 +1,191 @@
+#!/bin/sh
+
+# This script is a frontend designed to create & launch a POSIX shell
+# environment suitable for use with Easy-RSA. mksh/Win32 is used with this
+# project; use with other POSIX shells for Windows may require modification to
+# this wrapper script.
+
+# SC2162 - read without -r will mangle backslashes
+# SC1091 - Not following source file
+# SC1003 - (info): Want to escape a single quote?
+# shellcheck disable=SC2162,SC1091,SC1003
+
+# intent confirmation helper func
+# modified from easyrsa
+confirm() {
+	# Unit test can bypass this confirm
+	[ "$EASYRSA_WIN_QUICK" ] && return
+	prompt="$1"
+	value="$2"
+	msg="$3"
+	input=""
+	print "\
+$msg
+
+Type the word '$value' to continue, or any other input to abort."
+	printf %s "  $prompt"
+	# shellcheck disable=SC2162 # read without -r - confirm()
+	read input
+	printf '\n'
+	[ "$input" = "$value" ] && return
+	unset -v EASYRSA_SILENT
+	notice "Aborting without confirmation."
+	exit 1
+} # => confirm()
+
+# Access denied error
+access_denied() {
+		echo "Cannot locate or use a User-Home directory."
+		echo "Press [Enter] to exit."
+		read
+		exit 1
+} # => access_denied()
+
+# Administrator access Required tests
+admin_access() {
+	mkdir "$1" 2>/dev/null || return 1
+	[ -d "$1" ] || return 1
+	echo 1 >"$1"/1 2>/dev/null || return 1
+	[ -f "$1"/1 ] || return 1
+	rm -rf "$1" 2>/dev/null || return 1
+	[ ! -d "$1" ] || return 1
+} # => admin_access()
+
+# Setup "$HOMEDRIVE\$HOMEPATH\OpenVPN\easy-rsa" directory
+use_home_dir() {
+	if [ "$USERPROFILE" ]; then
+		# Use $USERPROFILE
+		user_home="$USERPROFILE"
+	elif [ "$HOMEDRIVE" ]; then
+		if [ "$HOMEPATH" ]; then
+			# Use $HOMEDRIVE and $HOMEPATH
+			user_home="${HOMEDRIVE}${HOMEPATH}"
+		else
+			user_home=
+		fi
+	else
+		user_home=
+	fi
+
+	# If no $user_home was identified
+	[ "$user_home" ] || access_denied
+
+	# Use $user_home/openvpn directory
+	cd "$user_home"/openvpn || access_denied
+
+	# Create $user_home/openvpn/easy-rsa directory
+	if [ ! -d easy-rsa ]; then
+		mkdir easy-rsa 2>/dev/null || access_denied
+		# Required test
+		[ -d easy-rsa ] || access_denied
+	fi
+
+	# Use $user_home/openvpn/easy-rsa directory
+	cd easy-rsa 2>/dev/null || access_denied
+
+	export HOME="$PWD"
+	export PATH="$HOME;$PATH"
+	unset -v user_home
+} # => use_home_dir()
+
+# set_var is defined as any vars file needs it.
+# This is the same as in easyrsa, but we _don't_ export
+set_var() {
+        var="$1"
+        shift
+        value="$*"
+        eval "$var=\"\${$var-$value}\""
+} #=> set_var()
+
+########################################
+# Invocation entry point:
+
+cd easyrsa3 || { echo "ERROR: Cannot find easyrsa3 directory"; exit 1; }
+
+echo "Starting Easy-RSA shell.."
+
+setup_path="${EASYRSA:-$PWD}"
+export PATH="$setup_path;$setup_path/bin;$PATH"
+export HOME="$setup_path"
+
+# This prevents reading from a user's .mkshrc if they have one.
+# A user who runs mksh for other purposes might have it
+export ENV="/disable-env"
+
+# Check for broken administrator access
+# https://github.com/OpenVPN/easy-rsa/issues/1072
+if admin_access "$HOME"/easyrsa-write-test; then
+	sec_lev='#'
+else
+	echo "
+To use Easy-RSA in a protected system directory, you must have
+full administrator privileges via Windows User Access Control."
+
+	confirm "Continue without administrator access ? " yes "
+Easy-RSA will now try to use your User-Home directory."
+
+	use_home_dir
+	sec_lev='$'
+	echo "
+NOTICE:
+Easy-RSA has been auto-configured to run in your User-Home directory."
+fi
+
+# Verify required externals are present
+extern_list="which awk cat cp mkdir printf rm grep sed"
+for f in $extern_list; do
+	if ! which "${f}.exe" >/dev/null 2>&1; then
+		echo ""
+		echo "FATAL: EasyRSA Shell init is missing a required external file:"
+		echo "  ${f}.exe"
+		echo "  Your installation is incomplete and cannot function without"
+		echo "  the required files."
+		echo ""
+		echo "Press Enter to exit."
+		read
+		exit 1
+	fi
+done
+
+# Check for a usable openssl bin, referencing vars if present
+[ -r "vars" ] && EASYRSA_CALLER=1 . "vars" 2>/dev/null
+if [ -z "$EASYRSA_OPENSSL" ] && ! which openssl.exe >/dev/null 2>&1; then
+	echo "WARNING: openssl isn't in your system PATH. The openssl binary must be"
+	echo "  available in the PATH, defined in the 'vars' file, or defined in a"
+	echo "  named environment variable. See README-Windows.txt for more info."
+fi
+
+[ -f "$setup_path/easyrsa" ] || {
+	echo "Missing easyrsa script. Expected to find it at: $setup_path/easyrsa"
+	echo "Press Enter to exit."
+	read
+	exit 1
+}
+
+# Check for openvpn executable
+if which openvpn.exe >/dev/null 2>&1; then
+	EASYRSA_OPENVPN="$(which openvpn.exe | sed s/'\\'/'\/'/g)" || {
+		echo "verify_openvpn - Failed to convert openvpn path."
+		echo "Press Enter to exit."
+		read
+		exit 1
+	}
+	export EASYRSA_OPENVPN="$EASYRSA_OPENVPN"
+else
+	echo "WARNING: openvpn.exe is not in your system PATH."
+	echo "EasyRSA will not be able to generate OpenVPN TLS keys."
+fi
+
+# Set prompt and welcome message
+export PS1="
+EasyRSA Shell:
+$USERNAME@$COMPUTERNAME $HOME $sec_lev "
+echo ""
+echo "Welcome to the EasyRSA 3 Shell for Windows."
+echo "Easy-RSA 3 is available under a GNU GPLv2 license."
+echo ""
+echo "Invoke 'easyrsa' to call the program. Without commands, help is displayed."
+
+cd ..
+
+./op-test.sh -w -p -v