--- openvpn-2.2.0-orig/easy-rsa/2.0/build-ca	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/build-ca	2011-04-27 22:34:59.357652908 +0200
@@ -4,5 +4,5 @@
 # Build a root certificate
 #
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact --initca $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact --initca $*
--- openvpn-2.2.0/easy-rsa/2.0/build-dh	2011-04-27 22:36:11.867656490 +0200
+++ easy-rsa-2.2.2/easy-rsa/2.0/build-dh	2015-06-02 21:31:45.871587248 +0300
@@ -3,4 +3,11 @@
 # Build Diffie-Hellman parameters for the server side
 # of an SSL/TLS connection.
 
+if [ -z "$EASY_RSA" ]; then
+       . /etc/easy-rsa/vars
+fi
+
+# Set tool defaults
+[ -n "$OPENSSL" ] || export OPENSSL="openssl"
+
 if [ -d $KEY_DIR ] && [ $KEY_SIZE ]; then
--- openvpn-2.2.0-orig/easy-rsa/2.0/build-inter	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/build-inter	2011-04-27 22:37:59.789289422 +0200
@@ -3,5 +3,5 @@
 # Make an intermediate CA certificate/private key pair using a locally generated
 # root certificate.
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact --inter $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact --inter $*
--- openvpn-2.2.0-orig/easy-rsa/2.0/build-key	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/build-key	2011-04-27 22:38:35.330924876 +0200
@@ -3,5 +3,5 @@
 # Make a certificate/private key pair using a locally generated
 # root certificate.
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact $*
--- openvpn-2.2.0-orig/easy-rsa/2.0/build-key-pass	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/build-key-pass	2011-04-27 22:39:23.919827311 +0200
@@ -3,5 +3,5 @@
 # Similar to build-key, but protect the private key
 # with a password.
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact --pass $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact --pass $*
--- openvpn-2.2.0-orig/easy-rsa/2.0/build-key-pkcs12	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/build-key-pkcs12	2011-04-27 22:40:10.288627524 +0200
@@ -4,5 +4,5 @@
 # root certificate and convert it to a PKCS #12 file including the
 # the CA certificate as well.
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact --pkcs12 $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact --pkcs12 $*
--- openvpn-2.2.0-orig/easy-rsa/2.0/build-key-server	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/build-key-server	2011-04-27 22:41:24.715385295 +0200
@@ -6,5 +6,5 @@
 # Explicitly set nsCertType to server using the "server"
 # extension in the openssl.cnf file.
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact --server $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact --server $*
--- openvpn-2.2.0-orig/easy-rsa/2.0/build-req	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/build-req	2011-04-27 22:41:59.636992013 +0200
@@ -3,5 +3,5 @@
 # Build a certificate signing request and private key.  Use this
 # when your root certificate and key is not available locally.
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact --csr $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact --csr $*
--- openvpn-2.2.0-orig/easy-rsa/2.0/build-req-pass	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/build-req-pass	2011-04-27 22:43:36.938135257 +0200
@@ -3,5 +3,5 @@
 # Like build-req, but protect your private key
 # with a password.
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact --csr --pass $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact --csr --pass $*
--- openvpn-2.2.0-orig/easy-rsa/2.0/clean-all	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/clean-all	2011-04-27 22:44:36.544210785 +0200
@@ -4,6 +4,10 @@
 # Note that this script does a
 # rm -rf on $KEY_DIR so be careful!
 
+if [ -z "$EASY_RSA" ]; then
+       . /etc/easy-rsa/vars
+fi
+
 if [ "$KEY_DIR" ]; then
     rm -rf "$KEY_DIR"
     mkdir "$KEY_DIR" && \
--- openvpn-2.2.0-orig/easy-rsa/2.0/inherit-inter	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/inherit-inter	2011-04-27 22:45:20.809580498 +0200
@@ -9,6 +9,10 @@
 # To build an intermediate CA, follow the same steps for a regular PKI but
 # replace ./build-key or ./pkitool --initca with this script.
 
+if [ -z "$EASY_RSA" ]; then
+       . /etc/easy-rsa/vars
+fi
+
 # The EXPORT_CA file will contain the CA certificate chain and should be
 # referenced by the OpenVPN "ca" directive in config files.  The ca.crt file
 # will only contain the local intermediate CA -- it's needed by the easy-rsa
--- easy-rsa-2.2.2/easy-rsa/2.0/list-crl	2015-06-02 21:09:57.640431912 +0300
+++ easy-rsa-2.2.2/easy-rsa/2.0/list-crl	2015-06-02 21:28:49.245772384 +0300
@@ -2,6 +2,13 @@
 
 # list revoked certificates
 
+if [ -z "$EASY_RSA" ]; then
+	. /etc/easy-rsa/vars
+fi
+
+# Set tool defaults
+[ -n "$OPENSSL" ] || export OPENSSL="openssl"
+
 CRL="${1:-crl.pem}"
 
 if [ "$KEY_DIR" ]; then
--- easy-rsa-2.2.2/easy-rsa/2.0/pkitool~	2015-06-02 21:08:57.000000000 +0300
+++ easy-rsa-2.2.2/easy-rsa/2.0/pkitool	2015-06-02 21:11:42.382534794 +0300
@@ -42,6 +42,10 @@
     exit 1
 }
 
+if [ -z "$EASY_RSA" ]; then
+       . /etc/easy-rsa/vars
+fi
+
 need_vars()
 {
     echo '  Please edit the vars script to reflect your configuration,'
--- openvpn-2.2.0/easy-rsa/2.0/revoke-full	2011-04-27 22:56:07.449351374 +0200
+++ easy-rsa-2.2.2/easy-rsa/2.0/revoke-full	2015-06-02 21:30:26.690819476 +0300
@@ -3,6 +3,13 @@
 # revoke a certificate, regenerate CRL,
 # and verify revocation
 
+if [ -z "$EASY_RSA" ]; then
+       . /etc/easy-rsa/vars
+fi
+
+# Set tool defaults
+[ -n "$OPENSSL" ] || export OPENSSL="openssl"
+
 CRL="crl.pem"
 RT="revoke-test.pem"
 
--- openvpn-2.2.0-orig/easy-rsa/2.0/sign-req	2011-04-06 18:05:52.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/sign-req	2011-04-27 22:56:46.124465700 +0200
@@ -3,5 +3,5 @@
 # Sign a certificate signing request (a .csr file)
 # with a local root certificate and key.
 
-export EASY_RSA="${EASY_RSA:-.}"
-"$EASY_RSA/pkitool" --interact --sign $*
+export EASY_RSA="${EASY_RSA:-/etc/easy-rsa}"
+/usr/sbin/pkitool --interact --sign $*
--- openvpn-2.2.0-orig/easy-rsa/2.0/vars	2010-10-21 11:18:17.000000000 +0200
+++ openvpn-2.2.0/easy-rsa/2.0/vars	2011-04-27 22:58:41.789791888 +0200
@@ -12,21 +12,12 @@
 # This variable should point to
 # the top level of the easy-rsa
 # tree.
-export EASY_RSA="`pwd`"
-
-#
-# This variable should point to
-# the requested executables
-#
-export OPENSSL="openssl"
-export PKCS11TOOL="pkcs11-tool"
-export GREP="grep"
-
+export EASY_RSA="/etc/easy-rsa"
 
 # This variable should point to
 # the openssl.cnf file included
 # with easy-rsa.
-export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
+export KEY_CONFIG="$EASY_RSA/openssl.cnf"
 
 # Edit this variable to point to
 # your soon-to-be-created key
@@ -38,9 +29,6 @@
 # it correctly!
 export KEY_DIR="$EASY_RSA/keys"
 
-# Issue rm -rf warning
-echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
-
 # PKCS11 fixes
 export PKCS11_MODULE_PATH="dummy"
 export PKCS11_PIN="dummy"