Which Easy-RSA Package Layout Did That Tutorial Use?

A tutorial tells you to edit vars in the Easy-RSA directory, and the directory on your machine has no such file. That is usually a generation mismatch rather than a broken package. Easy-RSA 2 kept a vars file beside shell helpers such as build-key; Easy-RSA 3 exposes one easyrsa command and reads configuration from a template plus command-line options. Find out which one you have before you copy anything from the guide.

Run these checks in order, because each one narrows the next.

1. Inventory what is installed

On a Debian-family system, ask the package manager which files it actually registered:

dpkg-query -L easy-rsa

The list for the current Debian package includes make-cadir, the easyrsa program, an OpenSSL configuration template and vars.example. That tells you what this distribution shipped. It does not tell you how another distribution or an upstream tarball laid out the same generation, so read the version before you interpret the paths. If the output shows no make-cadir at all, you are probably looking at a different packaging generation rather than a broken install.

easyrsa --version is the shortest way to know which generation you are reading about, and it is worth running before any other command in a guide.

2. Tell generation 2 from generation 3

Generation 2 shipped shell helpers and a vars file you were expected to edit. Generation 3 ships one easyrsa command with subcommands, and it reads configuration from a template plus explicit options.

That difference explains most file-not-found reports on this topic. A guide written for 2 tells you to source vars and run build-key, and a 3 install contains neither. Chasing the missing file from another machine's copy is how people end up running two generations against one PKI directory.

3. Separate the program directory from the PKI workspace

The installed program directory is read-only by design. Your PKI is a separate directory holding the CA, the issued certificates and the private keys, and that one carries the permissions you have to get right.

If an authority already exists, find its public certificate and confirm its state before you touch anything. Do not initialize a replacement, and do not overwrite the index because a tutorial used a different path. Copying public templates is harmless, while copying an issuer's private key is not, and in a shell the two operations look almost identical.

4. Check quoting before you chase a path

Text copied from a formatted page often arrives with typographic quotation marks. Bash treats only its documented ASCII delimiters as quoting, so a path wrapped in curly quotes becomes a literal filename that does not exist.

printf '%s\n' "$EASY_RSA"

That prints the value of one variable rather than the whole environment, which is what you want when the question is whether the value carries stray characters or whitespace. Do not assume EASY_RSA still selects configuration in generation 3; use the documented PKI directory option for the release you have instead.

5. Stop before you re-initialize anything

Once program generation, installed paths and workspace role agree, a remaining error is probably a permission or missing-state problem, and it deserves its own diagnosis rather than another workaround.

Installing a cached package from another release, copying directories recursively, or creating empty issuer records hides the original mismatch and adds a second one. Write down the version, the path and the exact error before you change anything. Those three are what turn the next step into a decision instead of another guess, and they keep the next person from repeating the search.