I've narrowed this down and I believe it's an easy-rsa bug. Version 3.0.8 works correctly, version 3.0.9 fails. The following outputs are from the same system using a downloaded version of openssl 3.7.1 and the above versions of easy-rsa download from github:
bsdtest# ./easyrsa version
WARNING: can't open config file: /home/EasyRSA-3.0.8/pki/safessl-easyrsa.cnf
EasyRSA Version Information
Version: 3.0.8
Generated: Wed Sep 9 15:59:45 CDT 2020
SSL Lib: LibreSSL 3.7.1
Git Commit: f12e00e53b4f486ce3d119ca429198780fa694ac
Source Repo:
https://github.com/OpenVPN/easy-rsa
bsdtest# ./easyrsa init-pki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /home/EasyRSA-3.0.8/pki
bsdtest# ./easyrsa build-ca nopass
Using SSL: openssl LibreSSL 3.7.1
Generating RSA private key, 2048 bit long modulus
....................................................................
........
e is 65537 (0x010001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/home/EasyRSA-3.0.8/pki/ca.crt
bsdtest#
----------------------------------------------------------------------------------
bsdtest# ./easyrsa version
WARNING: can't open config file: /home/EasyRSA-v3.0.9/pki/safessl-easyrsa.cnf
EasyRSA Version Information
Version: v3.0.9
Generated: Wed May 18 08:04:38 CDT 2022
SSL Lib: LibreSSL 3.7.1
Git Commit: 150e96ec9b290396ccbe160bd23f6dd1b277250d
Source Repo:
https://github.com/OpenVPN/easy-rsa
bsdtest# ./easyrsa init-pki
* Notice:
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is:
* /home/EasyRSA-v3.0.9/pki
IMPORTANT: Easy-RSA 'vars' file has now been moved to your PKI above.
bsdtest# ./easyrsa build-ca nopass
* Notice:
Using Easy-RSA configuration from: /home/EasyRSA-v3.0.9/pki/vars
* Notice:
Using SSL: openssl LibreSSL 3.7.1
usage: genpkey [-algorithm alg] [cipher] [-genparam] [-out file]
[-outform der | pem] [-paramfile file] [-pass arg]
[-pkeyopt opt:value] [-text]
-algorithm name Public key algorithm to use (must precede -pkeyopt)
-genparam Generate a set of parameters instead of a private key
-out file Output file to write to (default stdout)
-outform format Output format (DER or PEM)
-paramfile file File to load public key algorithm parameters from
(must precede -pkeyopt)
-pass arg Output file password source
-pkeyopt opt:value Set public key algorithm option to the given value
-text Print the private/public key in human readable form
Easy-RSA error:
Failed create CA private key
Host: nix | OpenBSD | /bin/ksh
bsdtest#
