diff --git a/doc/EasyRSA-Advanced.md b/doc/EasyRSA-Advanced.md index 1a6b3b7f2..a15aae3d7 100644 --- a/doc/EasyRSA-Advanced.md +++ b/doc/EasyRSA-Advanced.md @@ -85,6 +85,40 @@ Additionally, the contents of the env-var `EASYRSA_EXTRA_EXTS` is appended with its raw text added to the OpenSSL extensions. The contents are appended as-is to the cert extensions; invalid OpenSSL configs will usually result in failure. +Advanced configuration files +---------------------------- + +The following files are used by Easy-RSA to configure the SSL library: +* openssl-easyrsa.cnf - Configuration for Certificate Authority [CA] +* x509-types: COMMON, ca, server, serverClient, client, codeSigning, email, kdc. + Each type is used to define an X509 purpose. + +Since Easy-RSA version 3.2.0, these files are created on-demand by each command +that requires them. However, if these files are found in one of the supported +locations then those files are used instead, no temporary files are created. + +The supported locations are listed, in order of preference, as follows: +* `EASYRSA_PKI` - Always preferred. +* `EASYRSA` - For Windows. +* `PWD` - For Windows. +* `easyrsa` script directory - DEPRECATED, will be removed. Only for Windows. +* `/usr/local/share/easy-rsa` +* `/usr/share/easy-rsa` +* `/etc/easy-rsa` + +The files above can all be created by using command: `easyrsa write legacy