Solving the SSL problem in CVS head

[Alan DeKok]

A.L.M.Buxey at lboro.ac.uk wrote:
> it does sound funky but how does this interact with systems that already
> have signed certs etc etc installed/configured - eg doing a new
> install over older software?

  Two answers:

  1) Very well, thank you. :)

  2) raddb/certs/README

  Like everything else in "make install", it does *not* touch your
existing configuration.  Programmers that write code to blow away your
existing configuration when installing a new version are *bad* people.
They are *very* bad people, and I don't like them at all.

  If /etc/raddb/certs exists, the "make install" process doesn't touch
it.  Any existing eap.conf is likewise *not* touched on "make install".
 The default for "make_cert_command" is NULL, which means "don't run
it.".  Even if you did set "make_cert_command", when the server starts,
it would notice that /etc/raddb/certs/<server-cert> exists, so it won't
do anything on existing installations.  And even if the server
certificate didn't exist, it would see that /etc/raddb/certs/bootstrap
doesn't exist, so it wouldn't try to run it.

  In the end, this code has *zero* effect on existing installations.  It
has *beautiful* effects on brand-new installations.  And outside of a
few entries in a "Makefile", the change is about 30 lines of code...
most of which is sanity checking to ensure it doesn't over-write
existing installations, or run at the wrong time.

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog