doc: Revoke and Renew, update for Easy-RSA v3.2.1 - Renew CA

Signed-off-by: Richard T Bonhomme <[email protected]>

doc/EasyRSA-Renew-and-Revoke.md

@@ -6,7 +6,7 @@ with regard to Renewal and Revocation of Certificates.
 
 ## In summary:
 
- **Easy-RSA Version 3.1.7** provides the most flexible support of renewal.
+**Easy-RSA Version 3.1.7** provides the most flexible support of renewal.
 This includes command `rewind-renew`, which is required to recover certificates
 renewed by `renew` command version 1. However, this does **not** include renewing
 any supported certificate attributes.
@@ -33,7 +33,7 @@ The follow is an exhaustive list of available `reason` codes, with abbreviations
 ----
 
 Easy-RSA version 3.2.x
-----------------------
+======================
 For **Easy-RSA Version 3.2.0**, command `renew` is NOT supported.
 
 Please upgrade to Easy-RSA Version 3.2.1
@@ -75,11 +75,7 @@ to be edited the same way.
 ----
 
 Easy-RSA version 3.1.x
-----------------------
-
-**UPDATE**:
-The changes noted for Easy-RSA version 3.1.2 have all been included with
-Easy-RSA version 3.1.1 - See https://github.com/OpenVPN/easy-rsa/pull/688
+======================
 
 Command Details: `renew`
 ------------------------
@@ -190,4 +186,45 @@ an old certificate/key pair, which has been _rebuilt_ by command `rebuild`.
 Renew CA Certificate
 ====================
 
-TBD
+Easy-RSA Version 3.2.1+ supports a simple way to effectively renew a CA Certificate.
+
+**Preamble** - Specifically for use with OpenVPN:
+
+When a CA certificate expires it must be replaced, this is unavoidable.
+No matter what method is used to create a new or renewed CA certificate,
+that CA certificate must be distributed to all of your servers and clients.
+
+Please consider the method outlined here, which requires very little work:
+
+1. Make a backup of your current PKI, **before you do anything else.**
+
+2. Use command `init-pki soft`
+
+   This will reset your current PKI but will keep your `vars` setting file and
+   your current Request files [CSR], in the `pki/reqs` directory.
+
+3. Use command `build-ca`
+
+   (With or without password and other preferences)
+
+   This will build a completely new CA Certificate and private key.
+
+   Use option `--days` to extend the lifetime of your new CA.
+
+4. Use command `sign-req <TYPE> <NAME>`
+
+   (With or without other preferences, password is not relavent)
+
+   This will sign your existing request for each certificate that you choose.
+
+   This will NOT generate new private keys for each new certificate.
+
+   This will generate new `inline` files that can be distributed publicly.
+   These `inline` files will not contain any security sensitive data.
+
+   This means that you will have a new CA certificate and private key.
+   And signed certificates for all of your users, including servers.
+
+5. Distribute the new `inline` files to all members of your PKI/VPN.
+
+   This is the only Easy-RSA supported way to renew your CA certificate.