Easy-RSA Says the PKI Is Missing? It Is Looking Elsewhere

The command stops with a missing ca.crt or a missing index.txt, and the CA has been issuing certificates for months. Nothing about the authority changed; the command simply looked somewhere else. Easy-RSA 3 resolves a PKI directory from an option, an environment variable, a vars file and a built-in default, and any of those can point away from the deployment's authority. Check which one won before you create anything.

The error names a file, not a directory

The installation directory and the issuer directory are two different places. Finding easyrsa on the machine only proves the tool is installed, not that it found the authority your VPN trusts.

That is why reinstalling the package or re-running the init step feels productive and changes nothing.

Check the selector before anything else

In Easy-RSA 3 the selector is EASYRSA_PKI or the matching --pki-dir option. Pass an absolute path such as --pki-dir=/srv/pki/office and the answer stops depending on where you happened to be standing. That one habit removes a whole class of this bug, especially for scripts run from cron or from a CI checkout.

Confirm the generation first, because the Easy-RSA 2 habit of a vars file plus build-key is a different model from the one Easy-RSA 3 expects. easyrsa --version prints the generation before it does anything else, and ./easyrsa --help lists the subcommands: a build-key target means 2.x, while build-client-full means 3.x. Carrying an old KEY_DIR path into a 3.x invocation because the directory name looks familiar produces exactly this error.

If the version string and the command syntax disagree, stop and read the installed release's own documentation.

Precedence explains a vars file that lost

The documented precedence is command-line option, then environment, then vars file, then built-in default. A correct value in vars therefore loses to an inherited environment variable, and that is the quiet version of this failure. Inspect the intended variables and the file selection rather than dumping the whole environment into a ticket. The difference between the two is usually a secret.

Walk the chain in order and note which source supplied the path the command used. Once you know that, the fix is a flag or an export rather than a new certificate authority.

The Easy-RSA configuration reference defines the selector and the precedence, and it is the citation to put in the ticket.

Confirm the issuer with public material

With the usual file-based issuer, read ca.crt and match its fingerprint to the issuer record you approved. A matching subject name is not identity evidence, and neither is a directory called production. Only the fingerprint ties the file you found to the authority your peers were told to trust.

A read-only check is enough: openssl x509 -in /srv/pki/office/ca.crt -noout -subject -issuer -serial -fingerprint -sha256.

Then establish the directory's role. A request directory that a client uses is not an issuer database, and a signing key kept offline has no business existing on every VPN host. A missing ca.key is a design property in that layout, not permission to invent a replacement authority.

If the state really is gone

Sometimes the path is right and the state genuinely is not there. An empty index.txt and a restarted serial counter give you a PKI that looks healthy and cannot prove anything about the certificates it never saw: renewals will not revoke the old ones, and the new numbers will collide with history. Restore from the CA's approved backup instead, because initialising a blank PKI elsewhere merely moves the error and leaves a second, unrelated authority behind.

Once the path and the issuer agree, take the next failure on its merits. Permission denied, a signing key that needs its passphrase, and a missing issuance record are three different faults, and only one of them is about the directory you just fixed.

Never strip key encryption or widen directory permissions to paper over a path mistake. The mistake is cheap to fix; the repair is not.