# 使用 Homebrew, apk, apt, dnf, MacPorts, pacman, zypper, Nix, scoop 安装 easy-rsa 查看 easy-rsa 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:easy-rsa ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install easy-rsa ``` 证据: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install easy-rsa ``` 证据: MacPorts ports tree: security/easy-rsa/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add easy-rsa ``` 证据: Alpine Linux edge package indexes: easy-rsa from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install easy-rsa ``` 证据: Debian stable package indexes: easy-rsa from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install easy-rsa ``` 证据: Fedora Rawhide package metadata: easy-rsa from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst - pacman (92%): ```sh sudo pacman -S easy-rsa ``` 证据: Arch Linux sync databases: easy-rsa from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install easy-rsa ``` 证据: openSUSE Tumbleweed package metadata: easy-rsa from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#easyrsa ``` 证据: nixpkgs package indexes: pkgs/by-name/ea/easyrsa/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ### Windows - Scoop (92%): ```sh scoop install extras/easyrsa ``` 证据: Scoop official bucket manifest trees: bucket/easyrsa.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 ## 软件包事实 - **软件包键:** brew:easy-rsa - **软件包管理器:** Homebrew - **版本:** 3.2.6 - **来源摘要:** CLI utility to build and manage a PKI CA - **主页:** - **仓库:** - **最后更新:** 2026-06-22T14:03:13-07:00 - **已生成:** 2026-08-03T19:37:03+00:00 ## 可执行文件 - easyrsa (别名) ## 安装行为 - Bottle: 不可用 ## 版本和新鲜度 - 页面生成时间: 2026-08-03 - 管理器版本: 3.2.6 ## 项目历史与用法 Easy-RSA is OpenVPN's shell-based CLI utility for creating and managing a small X.509 public key infrastructure. It is best known as the practical certificate-authority helper that many OpenVPN administrators install when they need to generate a CA, server/client certificates, requests, and certificate revocation lists without operating a full CA platform. ### 项目历史 Easy-RSA originated in the OpenVPN ecosystem and still co-exists with OpenVPN development while remaining a separate project. The official README describes current development on the 3.x release cycle and keeps prior 2.x and 1.x lines as release branches for tracking and possible back-porting. The 3.x documentation describes a portable POSIX shell implementation with OpenSSL as the cryptographic backend. Easy-RSA 3 changed the configuration model from older versions: it can run with built-in defaults and no mandatory config file, while optional settings can come from command-line options, environment variables, or a `vars` file. The tool's long-lived value is its narrowness. It does not try to be a web CA, enterprise PKI service, or certificate inventory system. It gives OpenVPN and TLS administrators a scriptable way to initialize a `pki` directory, build a CA, import certificate requests, sign client/server/intermediate certificates, revoke certificates, and generate CRLs. ### 采用历史 Easy-RSA became widely packaged because OpenVPN deployments frequently need a local certificate authority. The input source facts show package-manager coverage across Homebrew, Debian, Ubuntu, Fedora/DNF, Arch/pacman, Alpine, openSUSE/zypper, MacPorts, Nix, and Scoop. That packaging footprint is the adoption story: Easy-RSA is not a flashy standalone application, but it is the small utility administrators expect to find next to OpenVPN in OS package repositories. Homebrew packages the official release tarball from GitHub, and the README points users to GitHub releases or named tags for downloads. Easy-RSA 3 remains active enough for OpenSSL 3 compatibility concerns to shape branch status. The README marks older 3.0.x and release/2.x branches as not compatible with OpenSSL 3, while master tracks the 3.2.x rolling line. ### 使用方式 The quickstart flow is the classic CA workflow: run `easyrsa init-pki`, `easyrsa build-ca`, generate a keypair/request on the requesting system, import the request on the CA system, sign it as a client/server/CA type, and move the signed certificate back to the requester. Operational commands cover revocation and CRL publication (`easyrsa revoke`, `easyrsa gen-crl`), Diffie-Hellman parameter generation, request/certificate inspection, and private-key passphrase changes. The documentation recommends using releases rather than the rolling master branch. Easy-RSA stores generated CA state in the `pki` directory, including CA certificates, private keys, serial numbers, issued certificates, request files, and revocation data. That makes the package easy to understand and easy to back up, but also puts responsibility for private-key handling on the administrator. ### 为什么软件包爱好者会关心 Easy-RSA matters to package nerds because it is a tiny utility with an outsized operational footprint. A single shell script plus OpenSSL became the common path for bootstrapping PKI in OpenVPN environments across many Unix distributions. It is also a reminder that important packages are not always daemons or libraries. Sometimes the historically important package is a CLI that administrators run only when they provision, rotate, or revoke certificates, then leave untouched for months. ### 时间线 - Pre-3.x: Easy-RSA 1.x and 2.x existed as earlier OpenVPN-era release branches. - 3.x: Easy-RSA moved to the current POSIX shell/OpenSSL-backed project line with optional `vars` configuration and built-in defaults. - 2025: Homebrew packages Easy-RSA 3.2.x from official GitHub release tarballs. - 2026: The official README tracks master as the active 3.2.x rolling development branch and marks older 3.0/2.x/1.x lines as archived or unmaintained. ### Related projects - OpenVPN is the adjacent VPN project and community context in which Easy-RSA is documented and supported. - OpenSSL is the cryptographic backend used for certificate and key operations. - X.509 PKI, certificate revocation lists, certificate signing requests, and intermediate CAs are the standards and workflows Easy-RSA automates. ### 来源 - - - - ## 安全说明 narrow executable package without higher-risk signals. - **Geiger 风险:** 绿色 / 低 - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: pki/vars, vars ## 其他软件包管理器记录 - Debian apt - easy-rsa - 3.2.2-1: normalized package name match | Debian stable package indexes: easy-rsa from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - Ubuntu apt - easy-rsa - 3.1.7-2: normalized package name match | Ubuntu 24.04 LTS package indexes: easy-rsa from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - apk - easy-rsa - 3.2.5-r0: normalized package name match | Alpine Linux edge package indexes: easy-rsa from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - apk - easy-rsa-doc - 3.2.5-r0: normalized package name match | Alpine Linux edge package indexes: easy-rsa-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Simple shell based CA utility (documentation) | https://github.com/OpenVPN/easy-rsa - dnf - easy-rsa - 3.2.6-3.fc45: normalized package name match | Fedora Rawhide package metadata: easy-rsa from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - pacman - easy-rsa - 3.2.6-1: normalized package name match | Arch Linux sync databases: easy-rsa from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Simple shell based CA utility | https://github.com/OpenVPN/easy-rsa - zypper - easy-rsa - 3.2.6-1.2: normalized package name match | openSUSE Tumbleweed package metadata: easy-rsa from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | CLI utility to build and manage a PKI CA | https://github.com/OpenVPN/easy-rsa - MacPorts - easy-rsa: normalized package name match | MacPorts ports tree: security/easy-rsa/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Nix - easyrsa: installed executable or alias match | nixpkgs package indexes: pkgs/by-name/ea/easyrsa/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Scoop - extras/easyrsa: installed executable or alias match | Scoop official bucket manifest trees: bucket/easyrsa.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 ## Combined YAML source View the package source record on GitHub. [combined/easy-rsa.yml](https://github.com/mxcl/pkgdb/blob/main/combined/easy-rsa.yml) ## 来源 - pkg.so package database - Geiger risk classifier - curated configuration and credential file locations - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph