# easy-rsa を Homebrew, apk, apt, dnf, MacPorts, pacman, zypper, Nix, scoop でインストール easy-rsa のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。 ## インストール ```sh sudo av install brew:easy-rsa ``` 追加のインストールコマンド: ### macOS - Homebrew (100%): ```sh brew install easy-rsa ``` 証拠: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install easy-rsa ``` 証拠: MacPorts ports tree: security/easy-rsa/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add easy-rsa ``` 証拠: Alpine Linux edge package indexes: easy-rsa from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install easy-rsa ``` 証拠: Debian stable package indexes: easy-rsa from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install easy-rsa ``` 証拠: Fedora Rawhide package metadata: easy-rsa from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst - pacman (92%): ```sh sudo pacman -S easy-rsa ``` 証拠: Arch Linux sync databases: easy-rsa from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install easy-rsa ``` 証拠: openSUSE Tumbleweed package metadata: easy-rsa from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#easyrsa ``` 証拠: nixpkgs package indexes: pkgs/by-name/ea/easyrsa/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ### Windows - Scoop (92%): ```sh scoop install extras/easyrsa ``` 証拠: Scoop official bucket manifest trees: bucket/easyrsa.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 ## パッケージ情報 - **パッケージキー:** brew:easy-rsa - **パッケージマネージャ:** Homebrew - **バージョン:** 3.2.6 - **ソース概要:** CLI utility to build and manage a PKI CA - **ホームページ:** - **リポジトリ:** - **最終更新:** 2026-06-22T14:03:13-07:00 - **生成日時:** 2026-08-03T19:37:03+00:00 ## 実行可能ファイル - easyrsa (エイリアス) ## インストール挙動 - Bottle: 利用不可 ## バージョンと鮮度 - ページ生成日: 2026-08-03 - マネージャ版: 3.2.6 ## プロジェクトの歴史と使われ方 Easy-RSA is OpenVPN's shell-based CLI utility for creating and managing a small X.509 public key infrastructure. It is best known as the practical certificate-authority helper that many OpenVPN administrators install when they need to generate a CA, server/client certificates, requests, and certificate revocation lists without operating a full CA platform. ### プロジェクトの歴史 Easy-RSA originated in the OpenVPN ecosystem and still co-exists with OpenVPN development while remaining a separate project. The official README describes current development on the 3.x release cycle and keeps prior 2.x and 1.x lines as release branches for tracking and possible back-porting. The 3.x documentation describes a portable POSIX shell implementation with OpenSSL as the cryptographic backend. Easy-RSA 3 changed the configuration model from older versions: it can run with built-in defaults and no mandatory config file, while optional settings can come from command-line options, environment variables, or a `vars` file. The tool's long-lived value is its narrowness. It does not try to be a web CA, enterprise PKI service, or certificate inventory system. It gives OpenVPN and TLS administrators a scriptable way to initialize a `pki` directory, build a CA, import certificate requests, sign client/server/intermediate certificates, revoke certificates, and generate CRLs. ### 採用の歴史 Easy-RSA became widely packaged because OpenVPN deployments frequently need a local certificate authority. The input source facts show package-manager coverage across Homebrew, Debian, Ubuntu, Fedora/DNF, Arch/pacman, Alpine, openSUSE/zypper, MacPorts, Nix, and Scoop. That packaging footprint is the adoption story: Easy-RSA is not a flashy standalone application, but it is the small utility administrators expect to find next to OpenVPN in OS package repositories. Homebrew packages the official release tarball from GitHub, and the README points users to GitHub releases or named tags for downloads. Easy-RSA 3 remains active enough for OpenSSL 3 compatibility concerns to shape branch status. The README marks older 3.0.x and release/2.x branches as not compatible with OpenSSL 3, while master tracks the 3.2.x rolling line. ### 使われ方 The quickstart flow is the classic CA workflow: run `easyrsa init-pki`, `easyrsa build-ca`, generate a keypair/request on the requesting system, import the request on the CA system, sign it as a client/server/CA type, and move the signed certificate back to the requester. Operational commands cover revocation and CRL publication (`easyrsa revoke`, `easyrsa gen-crl`), Diffie-Hellman parameter generation, request/certificate inspection, and private-key passphrase changes. The documentation recommends using releases rather than the rolling master branch. Easy-RSA stores generated CA state in the `pki` directory, including CA certificates, private keys, serial numbers, issued certificates, request files, and revocation data. That makes the package easy to understand and easy to back up, but also puts responsibility for private-key handling on the administrator. ### パッケージ好きにとっての重要性 Easy-RSA matters to package nerds because it is a tiny utility with an outsized operational footprint. A single shell script plus OpenSSL became the common path for bootstrapping PKI in OpenVPN environments across many Unix distributions. It is also a reminder that important packages are not always daemons or libraries. Sometimes the historically important package is a CLI that administrators run only when they provision, rotate, or revoke certificates, then leave untouched for months. ### タイムライン - Pre-3.x: Easy-RSA 1.x and 2.x existed as earlier OpenVPN-era release branches. - 3.x: Easy-RSA moved to the current POSIX shell/OpenSSL-backed project line with optional `vars` configuration and built-in defaults. - 2025: Homebrew packages Easy-RSA 3.2.x from official GitHub release tarballs. - 2026: The official README tracks master as the active 3.2.x rolling development branch and marks older 3.0/2.x/1.x lines as archived or unmaintained. ### Related projects - OpenVPN is the adjacent VPN project and community context in which Easy-RSA is documented and supported. - OpenSSL is the cryptographic backend used for certificate and key operations. - X.509 PKI, certificate revocation lists, certificate signing requests, and intermediate CAs are the standards and workflows Easy-RSA automates. ### ソース - - - - ## セキュリティノート narrow executable package without higher-risk signals. - **Geiger リスク:** グリーン / 低 - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: pki/vars, vars ## 他のパッケージマネージャ記録 - Debian apt - easy-rsa - 3.2.2-1: normalized package name match | Debian stable package indexes: easy-rsa from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - Ubuntu apt - easy-rsa - 3.1.7-2: normalized package name match | Ubuntu 24.04 LTS package indexes: easy-rsa from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - apk - easy-rsa - 3.2.5-r0: normalized package name match | Alpine Linux edge package indexes: easy-rsa from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - apk - easy-rsa-doc - 3.2.5-r0: normalized package name match | Alpine Linux edge package indexes: easy-rsa-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Simple shell based CA utility (documentation) | https://github.com/OpenVPN/easy-rsa - dnf - easy-rsa - 3.2.6-3.fc45: normalized package name match | Fedora Rawhide package metadata: easy-rsa from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - pacman - easy-rsa - 3.2.6-1: normalized package name match | Arch Linux sync databases: easy-rsa from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - zypper - easy-rsa - 3.2.6-1.2: normalized package name match | openSUSE Tumbleweed package metadata: easy-rsa from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | CLI utility to build and manage a PKI CA | https://github.com/OpenVPN/easy-rsa - MacPorts - easy-rsa: normalized package name match | MacPorts ports tree: security/easy-rsa/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Nix - easyrsa: installed executable or alias match | nixpkgs package indexes: pkgs/by-name/ea/easyrsa/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Scoop - extras/easyrsa: installed executable or alias match | Scoop official bucket manifest trees: bucket/easyrsa.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 ## Combined YAML source View the package source record on GitHub. [combined/easy-rsa.yml](https://github.com/mxcl/pkgdb/blob/main/combined/easy-rsa.yml) ## ソース - pkg.so package database - Geiger risk classifier - curated configuration and credential file locations - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph