man isakmpd typos

Hi IPv6/IPSec masters,

Reading the manual page for isakmpd, I think I found some typos in the
X509 authentication section. Currently, it reads:

     2.   Create Certificate Signing Requests (CSRs) for IKE peers.  The CSRs
          are signed with a pre-generated private key.

          This step, as well as the next one, needs to be done for every peer.
          Furthermore the last step will need to be done once for each ID you
          want the peer to have.  The 10.0.0.1 below symbolizes that ID, in
          this case an IPv4 ID, and should be changed for each invocation.
          You will be asked for a DN for each run.  Encoding the ID in the
          common name is recommended, as it should be unique.

                # openssl req -new -key /etc/isakmpd/private/local.key \
                        -out /etc/isakmpd/private/10.0.0.1.csr

I think the command is wrong. The "-key" command-line argument tells
OpenSSL where the existing RSA private key is located. However, since
we are requesting a new CSR and they key does not exist yet (in the
manual page I can't seem to find any sentence that states this fact),
the previously listed command will fail:

Error opening Private Key /etc/isakmpd/private/local.key
20798:error:02001002:system library:fopen:No such file or
directory:/usr/src/lib/libssl/src/crypto/bio/bss_file.c:278:fopen('/etc/isakmpd/private/local.key','r')
20798:error:20074002:BIO routines:FILE_CTRL:system
lib:/usr/src/lib/libssl/src/crypto/bio/bss_file.c:280:
unable to load Private Key

I think the manual page should list the following commands:

  # openssl genrsa -out /etc/isakmpd/private/local.key

This will generate a (by default, 1024 bits) RSA private key. Then,
this command will generate the Certificate Signing Request:

  # openssl req -new -key /etc/isakmpd/private/local.key -out
/etc/isakmpd/private/10.0.0.1.csr

Can you comment?
Thanks!

-- 
http://www.felipe-alfaro.org/blog/disclaimer/