From: Stefan Winter <restena-sw@users.noreply.github.com>
Date: Sun, 8 Sep 2019 06:35:54 +0000 (+0200)
Subject: ue correct CA password when not the default "whatever"
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7aa17bd383a8a72bbc8dafbd65c4f7ee7e381097;p=thirdparty%2Ffreeradius-server.git

ue correct CA password when not the default "whatever"

without passin and passout, the CA passphrase is taken from ca.cnf where it is "whatever". In passwords.mk it is also "whatever" so that is usually okay.
However when changing the password in passwords.mk, the CA is still generated with "whatever" but subsequent cert generation commands use the custom password -> failure.
---

diff --git a/raddb/certs/Makefile b/raddb/certs/Makefile
index e4ebab15e32..24bc249e9cc 100644
--- a/raddb/certs/Makefile
+++ b/raddb/certs/Makefile
@@ -87,7 +87,8 @@ dh:
 rsa/ca.key rsa/ca.pem: ca.cnf | $(OUTPUT_DIRS)
 	@[ -f index.txt ] || $(MAKE) index.txt
 	@[ -f serial ] || $(MAKE) serial
-	openssl req -new -x509 -keyout rsa/ca.key -out rsa/ca.pem -config ./ca.cnf -days $(CA_DEFAULT_DAYS)
+	openssl req -new -x509 -keyout rsa/ca.key -out rsa/ca.pem -config ./ca.cnf -days $(CA_DEFAULT_DAYS) \
+	-passin pass:$(PASSWORD_CA) -passout pass:$(PASSWORD_CA)
 
 rsa/ca.der: rsa/ca.pem
 	openssl x509 -inform PEM -outform DER -in rsa/ca.pem -out rsa/ca.der