From f248cdc0fedd33318cc54837863f8454b560f2ec Mon Sep 17 00:00:00 2001
From: Chris Buechler <cmb@pfsense.org>
Date: Mon, 12 Oct 2015 22:03:59 -0500
Subject: [PATCH] Remove strongswan's cert directories and repopulate them, to
 ensure no removed CAs, certs, or CRLs remain. Ticket #5238

---
 etc/inc/vpn.inc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 35ff661a3b..5003589fdf 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -176,6 +176,11 @@ function vpn_ipsec_configure($restart = false) {
 	if (!is_dir("{$g['varetc_path']}/ipsec/ipsec.d")) {
 		mkdir("{$g['varetc_path']}/ipsec/ipsec.d");
 	}
+	// delete these paths first to ensure old CAs, certs and CRLs aren't left behind. redmine #5238
+	rmdir_recursive($capath);
+	rmdir_recursive($keypath);
+	rmdir_recursive($crlpath);
+	rmdir_recursive($certpath);
 	if (!is_dir($capath)) {
 		mkdir($capath);
 	}