diff --git a/security/dogtag-pki/Makefile b/security/dogtag-pki/Makefile
index 0f8a96dd5711..90ca09f6d05b 100644
--- a/security/dogtag-pki/Makefile
+++ b/security/dogtag-pki/Makefile
@@ -1,362 +1,362 @@
 PORTNAME=	dogtag-pki
 DISTVERSIONPREFIX=	v
 DISTVERSION=	11.7.0
-PORTREVISION=	5
+PORTREVISION=	6
 CATEGORIES=	security java python
 
 MAINTAINER=	joneum@FreeBSD.org
 COMMENT=	Dogtag PKI certificate system and server components
 WWW=		https://github.com/dogtagpki/pki
 
 LICENSE=	GPLv2
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 _JAVA_DEPENDS=	${JAVAJARDIR}/commons-cli.jar:java/apache-commons-cli \
 		${JAVAJARDIR}/commons-codec.jar:java/apache-commons-codec \
 		${JAVAJARDIR}/commons-io.jar:devel/apache-commons-io \
 		${JAVAJARDIR}/commons-lang3.jar:java/apache-commons-lang3 \
 		${JAVAJARDIR}/commons-logging.jar:java/apache-commons-logging \
 		${JAVAJARDIR}/commons-net.jar:net/apache-commons-net \
 		${JAVAJARDIR}/httpclient.jar:www/httpclient \
 		${JAVAJARDIR}/httpcore.jar:www/httpcore \
 		${JAVAJARDIR}/jackson-annotations.jar:devel/jackson-annotations \
 		${JAVAJARDIR}/jackson-core.jar:devel/jackson-core \
 		${JAVAJARDIR}/jackson-databind.jar:devel/jackson-databind \
 		${JAVAJARDIR}/jackson-jaxrs-json-provider.jar:devel/jackson-jaxrs-providers \
 		${JAVAJARDIR}/jackson-module-jaxb-annotations.jar:devel/jackson-module-jaxb-annotations \
 		${JAVAJARDIR}/jakarta.activation-api.jar:devel/jakarta-activation-api \
 		${JAVAJARDIR}/jakarta.annotation-api.jar:devel/jakarta-annotation-api \
 		${JAVAJARDIR}/jakarta.xml.bind-api.jar:devel/jakarta-xml-bind-api \
 		${JAVAJARDIR}/javax.ws.rs-api.jar:devel/javax-ws-rs-api \
 		${JAVAJARDIR}/javax.activation-api.jar:devel/javax-activation-api \
 		${JAVAJARDIR}/jaxb-api.jar:devel/jaxb-api \
 		${JAVAJARDIR}/jboss-logging.jar:devel/jboss-logging \
 		dogtag-jss>=5.7.0:security/dogtag-jss \
 		${JAVAJARDIR}/ldapjdk.jar:net/dogtag-ldap-sdk \
 		${JAVAJARDIR}/resteasy-servlet-initializer.jar:devel/resteasy \
 		${JAVAJARDIR}/slf4j-api.jar:devel/slf4j
 
 BUILD_DEPENDS=	${_JAVA_DEPENDS} \
 		${LOCALBASE}/apache-tomcat-9.0/lib/jaspic-api.jar:www/tomcat9 \
 		${LOCALBASE}/apache-tomcat-9.0/lib/servlet-api.jar:www/tomcat9 \
 		${PY_SETUPTOOLS} \
 		${PYTHON_PKGNAMEPREFIX}wheel>0:devel/py-wheel@${PY_FLAVOR}
 
 LIB_DEPENDS=	libapr-1.so:devel/apr1 \
 		libldap.so:net/openldap26-client \
 		libnspr4.so:devel/nspr \
 		libnss3.so:security/nss
 
 RUN_DEPENDS=	${_JAVA_DEPENDS} \
 		${LOCALBASE}/apache-tomcat-9.0/bin/catalina.sh:www/tomcat9 \
 		${LOCALBASE}/lib/pkcs11/p11-kit-trust.so:security/p11-kit \
 		${PYTHON_PKGNAMEPREFIX}cryptography>0:security/py-cryptography@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}lxml>0:devel/py-lxml@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}python-ldap>0:net/py-python-ldap@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}requests>0:www/py-requests@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR} \
 		bash:shells/bash
 
 USES=		cmake:indirect java:build,run pkgconfig python shebangfix
 USE_GITHUB=	yes
 GH_ACCOUNT=	dogtagpki
 GH_PROJECT=	pki
 JAVA_VERSION=	17
 USE_LDCONFIG=	yes
 USE_PYTHON=	autoplist pep517
 
 SHEBANG_FILES=	base/common/upgrade/*/*.py base/server/scripts/operations \
 		base/server/scripts/pkidaemon base/server/upgrade/*/*.py
 
 CMAKE_ARGS=	-DAPP_SERVER=tomcat-9.0 \
 		-DCOMMONS_CLI_JAR=${JAVAJARDIR}/commons-cli.jar \
 		-DCOMMONS_CODEC_JAR=${JAVAJARDIR}/commons-codec.jar \
 		-DCOMMONS_IO_JAR=${JAVAJARDIR}/commons-io.jar \
 		-DCOMMONS_LANG3_JAR=${JAVAJARDIR}/commons-lang3.jar \
 		-DCOMMONS_LOGGING_JAR=${JAVAJARDIR}/commons-logging.jar \
 		-DCOMMONS_NET_JAR=${JAVAJARDIR}/commons-net.jar \
 		-DHTTPCLIENT_JAR=${JAVAJARDIR}/httpclient.jar \
 		-DHTTPCORE_JAR=${JAVAJARDIR}/httpcore.jar \
 		-DJACKSON_ANNOTATIONS_JAR=${JAVAJARDIR}/jackson-annotations.jar \
 		-DJACKSON_CORE_JAR=${JAVAJARDIR}/jackson-core.jar \
 		-DJACKSON_DATABIND_JAR=${JAVAJARDIR}/jackson-databind.jar \
 		-DJACKSON_JAXRS_BASE_JAR=${JAVAJARDIR}/jackson-jaxrs-base.jar \
 		-DJACKSON_JAXRS_JSON_PROVIDER_JAR=${JAVAJARDIR}/jackson-jaxrs-json-provider.jar \
 		-DJACKSON_MODULE_JAXB_ANNOTATIONS_JAR=${JAVAJARDIR}/jackson-module-jaxb-annotations.jar \
 		-DJAKARTA_ACTIVATION_API_JAR=${JAVAJARDIR}/jakarta.activation-api.jar \
 		-DJAKARTA_ANNOTATION_API_JAR=${JAVAJARDIR}/jakarta.annotation-api.jar \
 		-DJASPIC_API_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/jaspic-api.jar \
 		-DJAVA_HOME=${JAVA_HOME} \
 		-DJAVA_JAR_INSTALL_DIR=${JAVAJARDIR} \
 		-DJAVA_LIB_INSTALL_DIR=${JAVAJARDIR} \
 		-DJAXB_API_JAR=${JAVAJARDIR}/jakarta.xml.bind-api.jar \
 		-DJAXRS_API_JAR=${JAVAJARDIR}/javax.ws.rs-api.jar \
 		-DJBOSS_LOGGING_JAR=${JAVAJARDIR}/jboss-logging.jar \
 		-DJSS_JAR=${JAVAJARDIR}/jss.jar \
 		-DJSS_TOMCAT_9_0_JAR=${JAVAJARDIR}/jss-tomcat-9.0.jar \
 		-DJSS_TOMCAT_JAR=${JAVAJARDIR}/jss-tomcat.jar \
 		-DLDAPJDK_JAR=${JAVAJARDIR}/ldapjdk.jar \
 		-DP11_KIT_TRUST=${LOCALBASE}/lib/pkcs11/p11-kit-trust.so \
 		-DPYTHON3_SITE_PACKAGES=${PYTHONPREFIX_SITELIBDIR} \
 		-DPYTHON_EXECUTABLE=${PYTHON_CMD} \
 		-DRELEASE=${PORTREVISION:U0} \
 		-DRESTEASY_JACKSON_PROVIDER_JAR=${JAVAJARDIR}/resteasy-jackson2-provider.jar \
 		-DRESTEASY_JAXRS_JAR=${JAVAJARDIR}/resteasy-jaxrs.jar \
 		-DRESTEASY_SERVLET_INITIALIZER_JAR=${JAVAJARDIR}/resteasy-servlet-initializer.jar \
 		-DSERVLET_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/servlet-api.jar \
 		-DSLF4J_API_JAR=${JAVAJARDIR}/slf4j-api.jar \
 		-DSLF4J_JDK14_JAR=${JAVASHAREDIR}/slf4j/slf4j-jdk14.jar \
 		-DTOMCAT_API_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-api.jar \
 		-DTOMCAT_CATALINA_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/catalina.jar \
 		-DTOMCAT_COYOTE_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-coyote.jar \
 		-DTOMCAT_UTIL_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-util.jar \
 		-DTOMCAT_UTIL_SCAN_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-util-scan.jar \
 		-DVERSION=${DISTVERSION} \
 		-DWITH_PYTHON_DOCS=OFF
 
 CMAKE_ON=	WITH_ACME WITH_CA WITH_JAVA WITH_SERVER
 
 CMAKE_OFF=	RUN_TESTS WITH_CONSOLE WITH_EST WITH_JAVADOC WITH_KRA \
 		WITH_META WITH_OCSP WITH_TESTS WITH_THEME WITH_TKS WITH_TPS \
 		WITH_WURST
 
 CMAKE_SOURCE_PATH=	${WRKSRC}
 
 DATADIR=	${PREFIX}/share/pki
 
 SUB_FILES=	pki.conf pkidestroy pkispawn tomcat.conf
 SUB_LIST+=	JAVA_HOME=${JAVA_HOME} \
 		JAVALIBDIR=${JAVALIBDIR} \
 		PYTHON_CMD=${PYTHON_CMD}
 
 USERS=		pkiuser
 GROUPS=		pkiuser
 
 PORTDATA=	*
 
 _JAVA_BUILD_DIR=	${WRKDIR}/java-build
 
 _JAVA_TARGETS=	pki-acme-links tps_library java pki-ca-links pki-lib pki-server-common-lib \
 		pki-server-lib pki-server-webapp-lib
 
 _DOGTAG_JARS=	pki-acme.jar pki-ca.jar pki-common.jar pki-server-webapp.jar pki-server.jar \
 		pki-tomcat-9.0.jar pki-tomcat.jar pki-tools.jar
 
 _RLN_PLACEHOLDERS=${JAVAJARDIR}/jss-tomcat.jar \
 ${JAVAJARDIR}/jss-tomcat-9.0.jar \
 ${JAVAJARDIR}/resteasy-servlet-initializer.jar \
 ${JAVAJARDIR}/jaxb-api.jar \
 ${JAVAJARDIR}/javax.activation-api.jar
 
 post-build:
 # Configure the Java build tree
 	@${RM} -r ${_JAVA_BUILD_DIR}
 	@${MKDIR} ${_JAVA_BUILD_DIR}
 	cd ${_JAVA_BUILD_DIR} && \
 		${SETENVI} ${WRK_ENV} ${CONFIGURE_ENV} \
 		JAVA_HOME=${JAVA_HOME} \
 		${CMAKE_BIN} ${CMAKE_ARGS} ${CMAKE_SOURCE_PATH}
 
 # Build Java archives and runtime link trees
 	${SETENVI} ${WRK_ENV} ${MAKE_ENV} \
 		JAVA_HOME=${JAVA_HOME} \
 		${CMAKE_BIN} --build ${_JAVA_BUILD_DIR} \
 		--parallel ${MAKE_JOBS_NUMBER} \
 		--target ${_JAVA_TARGETS}
 
 post-install: post-install-runtime
 
 post-install-native:
 	@${MKDIR} ${STAGEDIR}${PREFIX}/lib
 	${INSTALL_LIB} ${_JAVA_BUILD_DIR}/base/tools/src/main/native/tpsclient/src/libpki-tps.so \
 		${STAGEDIR}${PREFIX}/lib/libpki-tps.so
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libpki-tps.so
 
 post-install-java: post-install-native
 	@${MKDIR} ${STAGEDIR}${JAVAJARDIR}/pki
 .for jar in ${_DOGTAG_JARS}
 	${INSTALL_DATA} ${_JAVA_BUILD_DIR}/dist/${jar} \
 		${STAGEDIR}${JAVAJARDIR}/pki/${jar}
 .endfor
 
 post-install-tools: post-install-java
 	@${MKDIR} ${STAGEDIR}${PREFIX}/bin \
 		${STAGEDIR}${PREFIX}/sbin
 	${INSTALL_SCRIPT} ${WRKSRC}/base/tools/bin/pki \
 		${STAGEDIR}${PREFIX}/bin/pki
 	${INSTALL_SCRIPT} ${WRKSRC}/base/common/sbin/pki-upgrade \
 		${STAGEDIR}${PREFIX}/sbin/pki-upgrade
 	${INSTALL_SCRIPT} ${WRKSRC}/base/server/scripts/pkidaemon \
 		${STAGEDIR}${PREFIX}/bin/pkidaemon
 	${INSTALL_SCRIPT} ${WRKSRC}/base/server/sbin/pki-server \
 		${STAGEDIR}${PREFIX}/sbin/pki-server
 	${INSTALL_SCRIPT} ${WRKDIR}/pkidestroy \
 		${STAGEDIR}${PREFIX}/sbin/pkidestroy
 	${INSTALL_SCRIPT} ${WRKDIR}/pkispawn \
 		${STAGEDIR}${PREFIX}/sbin/pkispawn
 
 post-install-common: post-install-tools
 	@${MKDIR} ${STAGEDIR}${DATADIR}
 	${INSTALL_DATA} ${WRKSRC}/pom.xml ${STAGEDIR}${DATADIR}/pom.xml
 .for dir in key upgrade
 	cd ${WRKSRC}/base/common && \
 		${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR} \
 		"! -name CMakeLists.txt"
 .endfor
 
 post-install-server: post-install-common
 	@${MKDIR} ${STAGEDIR}${DATADIR}/deployment \
 		${STAGEDIR}${DATADIR}/server \
 		${STAGEDIR}${DATADIR}/setup
 	cd ${WRKSRC}/base/server && \
 		${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/server
 .for dir in certs database upgrade
 	cd ${WRKSRC}/base/server && \
 		${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/server \
 		"! -name CMakeLists.txt"
 .endfor
 	cd ${WRKSRC}/base/server && \
 		${COPYTREE_SHARE} config ${STAGEDIR}${DATADIR}/deployment \
 		"! -name CMakeLists.txt"
 	cd ${WRKSRC}/base/server && \
 		${COPYTREE_SHARE} setup ${STAGEDIR}${DATADIR} \
 		"! -name CMakeLists.txt"
 	cd ${WRKSRC}/base/server/share && \
 		${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}/server \
 		"! -name CMakeLists.txt ! -path ./lib ! -path ./lib/* ! -path ./etc ! -path ./etc/*"
 	cd ${WRKSRC}/base/server && \
 		${COPYTREE_SHARE} etc ${STAGEDIR}${DATADIR}/server \
 		"! -name CMakeLists.txt"
 	cd ${WRKSRC}/base/server-webapp && \
 		${COPYTREE_SHARE} webapps ${STAGEDIR}${DATADIR}/server \
 		"! -name CMakeLists.txt"
 	cd ${WRKSRC}/base/tomcat-9.0 && \
 		${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/server \
 		"! -name CMakeLists.txt"
 
 post-install-ca: post-install-server
 	@${MKDIR} ${STAGEDIR}${DATADIR}/ca
 	cd ${WRKSRC}/base/ca && \
 		${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/ca
 .for dir in auth database
 	cd ${WRKSRC}/base/ca && \
 		${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/ca \
 		"! -name CMakeLists.txt"
 .endfor
 	cd ${WRKSRC}/base/ca/shared && \
 		${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}/ca \
 		"! -name CMakeLists.txt ! -path ./conf/CS.cfg"
 	cd ${WRKSRC}/base/ca/tomcat-9.0 && \
 		${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/ca \
 		"! -name CMakeLists.txt"
 
 post-install-acme: post-install-ca
 	@${MKDIR} ${STAGEDIR}${DATADIR}/acme \
 		${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF
 	cd ${WRKSRC}/base/acme && \
 		${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/acme
 .for dir in conf database issuer openshift realm webapps
 	cd ${WRKSRC}/base/acme && \
 		${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/acme \
 		"! -name CMakeLists.txt"
 .endfor
 	cd ${WRKSRC}/base/acme/tomcat-9.0 && \
 		${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/acme \
 		"! -name CMakeLists.txt"
 	cd ${_JAVA_BUILD_DIR}/base/acme/webapp && \
 		${COPYTREE_SHARE} lib \
 		${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF
 
 post-install-links: post-install-acme
 	@${MKDIR} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF \
 		${STAGEDIR}${DATADIR}/ca/webapps/ca/admin \
 		${STAGEDIR}${DATADIR}/server/common \
 		${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF
 	cd ${_JAVA_BUILD_DIR}/base/common && \
 		${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR}
 	cd ${_JAVA_BUILD_DIR}/base/server && \
 		${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR}/server
 	cd ${_JAVA_BUILD_DIR}/base/server/common && \
 		${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR}/server/common
 	cd ${_JAVA_BUILD_DIR}/base/server-webapp/webapp && \
 		${COPYTREE_SHARE} lib \
 		${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF
 	cd ${_JAVA_BUILD_DIR}/base/ca/webapp && \
 		${COPYTREE_SHARE} lib \
 		${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF
 	cd ${_JAVA_BUILD_DIR}/base/ca/webapp/admin && \
 		${COPYTREE_SHARE} . \
 		${STAGEDIR}${DATADIR}/ca/webapps/ca/admin
 
 	# Replace fragile upstream links with FreeBSD relative symlinks.
 	@${TOUCH} ${_RLN_PLACEHOLDERS:S,^,${STAGEDIR},}
 	@${RM} ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/jaxb-api.jar ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar
 	@${RM} ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/javax.activation-api.jar ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jaxb-api.jar
 	${RLN} ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar ${STAGEDIR}${DATADIR}/server/common/lib/jaxb-api.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/common/lib/javax.activation-api.jar
 	${RLN} ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar ${STAGEDIR}${DATADIR}/server/common/lib/javax.activation-api.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/jss-tomcat.jar ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat-9.0.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/jss-tomcat-9.0.jar ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat-9.0.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-tomcat.jar ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat-9.0.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-tomcat-9.0.jar ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat-9.0.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/common/lib/resteasy-servlet-initializer.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/server/common/lib/resteasy-servlet-initializer.jar
 	@${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-server.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-server.jar
 	@${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-ca.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-ca.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-ca.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server-webapp.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server-webapp.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server-webapp.jar
 	@${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/resteasy-servlet-initializer.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/resteasy-servlet-initializer.jar
 	@${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/resteasy-servlet-initializer.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/resteasy-servlet-initializer.jar
 	@${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin/console
 	${RLN} ${STAGEDIR}${DATADIR}/server/webapps/pki/admin/console ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin/console
 
 	@${RM} ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-server.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-server.jar
 	@${RM} ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-acme.jar
 	${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-acme.jar ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-acme.jar
 
 	@${RM} ${_RLN_PLACEHOLDERS:S,^,${STAGEDIR},}
 
 post-install-config: post-install-links
 	@${MKDIR} ${STAGEDIR}${DATADIR}/ca/conf \
 		${STAGEDIR}${DATADIR}/etc \
 		${STAGEDIR}${DATADIR}/scripts
 	${INSTALL_DATA} ${_JAVA_BUILD_DIR}/base/ca/shared/conf/CS.cfg \
 		${STAGEDIR}${DATADIR}/ca/conf/CS.cfg
 
 # Shared configuration and helper scripts
 	${INSTALL_DATA} ${WRKDIR}/pki.conf \
 		${STAGEDIR}${DATADIR}/etc/pki.conf
 	${INSTALL_DATA} ${WRKDIR}/tomcat.conf \
 		${STAGEDIR}${DATADIR}/etc/tomcat.conf
 	${INSTALL_DATA} ${WRKSRC}/base/common/share/etc/logging.properties \
 		${STAGEDIR}${DATADIR}/etc/logging.properties
 	${INSTALL_DATA} ${WRKSRC}/base/common/scripts/config \
 		${STAGEDIR}${DATADIR}/scripts/config
 	${INSTALL_SCRIPT} ${WRKSRC}/base/server/scripts/operations \
 		${STAGEDIR}${DATADIR}/scripts/operations
 
 post-install-version: post-install-config
 	${INSTALL_DATA} ${_JAVA_BUILD_DIR}/base/VERSION \
 		${STAGEDIR}${DATADIR}/VERSION
 	${ECHO_CMD} "Dogtag Certificate System" > ${WRKDIR}/CS_SERVER_VERSION
 	${INSTALL_DATA} ${WRKDIR}/CS_SERVER_VERSION \
 		${STAGEDIR}${DATADIR}/CS_SERVER_VERSION
 
 post-install-runtime: post-install-version
 	@${MKDIR} ${STAGEDIR}/var/log/pki
 
 .include <bsd.port.mk>
diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py
index 6287a1e98bc3..b6c3e1729ca6 100644
--- a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py
+++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py
@@ -1,491 +1,505 @@
 --- base/server/python/pki/server/__init__.py.orig	2025-08-05 19:20:05 UTC
 +++ base/server/python/pki/server/__init__.py
 @@ -51,9 +51,9 @@ import pki.server.subsystem
  from pki.keyring import Keyring
  import pki.server.subsystem
  
 -SYSCONFIG_DIR = '/etc/sysconfig'
 -ETC_SYSTEMD_DIR = '/etc/systemd'
 -LIB_SYSTEMD_DIR = '/lib/systemd'
 +SYSCONFIG_DIR = '/usr/local/etc'
 +RC_CONF_DIR = '/etc/rc.conf.d'
 +RC_DIR = '/usr/local/etc/rc.d'
  
  SUBSYSTEM_TYPES = ['ca', 'kra', 'ocsp', 'tks', 'tps', 'acme', 'est']
  
 @@ -62,7 +62,7 @@ SCHEMA_FILES = [
  DEFAULT_LINK_MODE = 0o0777
  
  SCHEMA_FILES = [
 -    '/usr/share/pki/server/database/ds/schema.ldif'
 +    '/usr/local/share/pki/server/database/ds/schema.ldif'
  ]
  
  logger = logging.getLogger(__name__)
 @@ -72,14 +72,14 @@ class Tomcat(object):
  
  class Tomcat(object):
  
 -    BASE_DIR = '/var/lib/tomcats'
 -    CONF_DIR = '/etc/tomcat'
 -    LIB_DIR = '/usr/share/java/tomcat'
 -    SHARE_DIR = '/usr/share/tomcat'
 -    EXECUTABLE = '/usr/sbin/tomcat'
 -    UNIT_FILE = '/lib/systemd/system/tomcat@.service'
 +    BASE_DIR = '/var/db/tomcats'
 +    CONF_DIR = '/usr/local/apache-tomcat-9.0/conf'
 +    LIB_DIR = '/usr/local/apache-tomcat-9.0/lib'
 +    SHARE_DIR = '/usr/local/apache-tomcat-9.0'
 +    EXECUTABLE = '/usr/local/apache-tomcat-9.0/bin/catalina.sh'
 +    UNIT_FILE = '/usr/local/etc/rc.d/tomcat9'
      SERVER_XML = CONF_DIR + '/server.xml'
 -    TOMCAT_CONF = CONF_DIR + '/tomcat.conf'
 +    TOMCAT_CONF = '/usr/local/share/pki/etc/tomcat.conf'
  
      @classmethod
      def get_version(cls):
 @@ -104,10 +104,10 @@ class PKIServer(object):
  @functools.total_ordering
  class PKIServer(object):
  
 -    BASE_DIR = '/var/lib/pki'
 -    CONFIG_DIR = '/etc/pki'
 +    BASE_DIR = '/var/db/pki'
 +    CONFIG_DIR = '/usr/local/etc/pki'
      LOG_DIR = '/var/log/pki'
 -    SHARE_DIR = '/usr/share/pki'
 +    SHARE_DIR = '/usr/local/share/pki'
      REGISTRY_DIR = SYSCONFIG_DIR + '/pki'
      TOMCAT_CONF = SHARE_DIR + '/etc/tomcat.conf'
  
 @@ -122,11 +122,11 @@ class PKIServer(object):
          self.user = user
          self.group = group
  
 -        # The standard conf dir at /var/lib/pki/<instance>/conf
 +        # The standard conf dir at /var/db/pki/<instance>/conf
          # will be an actual folder (i.e. not a link).
          self._conf_dir = None
  
 -        # The standard logs dir at /var/lib/pki/<instance>/logs
 +        # The standard logs dir at /var/db/pki/<instance>/logs
          # will be an actual folder (i.e. not a link).
          self._logs_dir = None
  
 @@ -243,9 +243,63 @@ class PKIServer(object):
          return '%s@%s' % (self.type, self.name)
  
      @property
 +    def rc_service_name(self):
 +        return ''.join(
 +            char if char.isalnum() or char == '_' else '_'
 +            for char in self.service_name)
 +
 +    @property
 +    def rc_script(self):
 +        return os.path.join(RC_DIR, self.rc_service_name)
 +
 +    @property
      def service_conf(self):
 -        return os.path.join(SYSCONFIG_DIR, self.service_name)
 +        return os.path.join(RC_CONF_DIR, self.rc_service_name)
  
 +    def create_rc_service(self, exist_ok=False):
 +        os.makedirs(RC_CONF_DIR, mode=0o755, exist_ok=True)
 +
 +        if not os.path.exists(self.service_conf) or not exist_ok:
 +            prefix = self.rc_service_name
 +            java_home = os.environ["JAVA_HOME"]
 +
 +            with open(self.service_conf, "w", encoding="utf-8") as f:
 +                print("%s_enable=\"YES\"" % prefix, file=f)
 +                print("%s_catalina_home=\"%s\"" % (prefix, Tomcat.SHARE_DIR), file=f)
 +                print("%s_catalina_base=\"%s\"" % (prefix, self.base_dir), file=f)
 +                print("%s_catalina_user=\"%s\"" % (prefix, self.user), file=f)
 +                print("%s_java_home=\"%s\"" % (prefix, java_home), file=f)
 +                tomcat_config = {}
 +                pki.util.load_properties(self.tomcat_conf, tomcat_config)
 +                java_opts = tomcat_config.get("JAVA_OPTS", "").strip(chr(34))
 +                pki_version = tomcat_config.get("PKI_VERSION", "").strip(chr(34))
 +                print('%s_java_opts="%s"' % (prefix, java_opts), file=f)
 +                print('%s_env="PKI_VERSION=%s"' % (prefix, pki_version), file=f)
 +
 +            os.chmod(self.service_conf, 0o644)
 +
 +        if os.path.lexists(self.rc_script):
 +            if exist_ok:
 +                return
 +            raise FileExistsError(self.rc_script)
 +
 +        os.symlink(os.path.join(RC_DIR, "tomcat9"), self.rc_script)
 +
 +    def remove_rc_service(self, force=False):
 +        logger.info("Removing %s", self.rc_script)
 +        pki.util.unlink(self.rc_script, force=force)
 +
 +        logger.info("Removing %s", self.service_conf)
 +        pki.util.remove(self.service_conf, force=force)
 +
 +        rcvar = "%s_enable" % self.rc_service_name
 +        logger.info("Removing %s from rc.conf", rcvar)
 +        subprocess.run(
 +            ["/usr/sbin/sysrc", "-x", rcvar],
 +            stdout=subprocess.DEVNULL,
 +            stderr=subprocess.DEVNULL,
 +            check=False)
 +
      @property
      def uid(self):
          return pwd.getpwnam(self.user).pw_uid
-@@ -295,7 +347,7 @@ class PKIServer(object):
+@@ -295,7 +349,7 @@ class PKIServer(object):
              raise pki.PKIException('Invalid instance: ' + self.name, None)
  
      def is_active(self):
 -        cmd = ['systemctl', '--quiet', 'is-active', '%s.service' % self.service_name]
 +        cmd = ['/usr/sbin/service', self.rc_service_name, 'onestatus']
          logger.debug('Command: %s', ' '.join(cmd))
          rc = subprocess.call(cmd)
          return rc == 0
-@@ -362,13 +414,13 @@ class PKIServer(object):
+@@ -362,13 +416,13 @@ class PKIServer(object):
          logger.info('Creating catalina.policy')
  
          # add "do not edit" warning
 -        filename = '/usr/share/pki/server/conf/catalina.policy'
 +        filename = '/usr/local/share/pki/server/conf/catalina.policy'
          logger.info('Appending %s', filename)
          with open(filename, 'r', encoding='utf-8') as f:
              content = f.read()
  
          # add Tomcat's default policy
 -        filename = '/usr/share/tomcat/conf/catalina.policy'
 +        filename = '/usr/local/apache-tomcat-9.0/conf/catalina.policy'
          logger.info('Appending %s', filename)
          with open(filename, 'r', encoding='utf-8') as f:
              content += f.read()
-@@ -376,7 +428,7 @@ class PKIServer(object):
+@@ -376,7 +430,7 @@ class PKIServer(object):
          content += '\n\n'
  
          # add PKI's default policy
 -        filename = '/usr/share/pki/server/conf/pki.policy'
 +        filename = '/usr/local/share/pki/server/conf/pki.policy'
          logger.info('Appending %s', filename)
          with open(filename, 'r', encoding='utf-8') as f:
              content += f.read()
-@@ -450,7 +502,7 @@ grant codeBase "file:%s" {
+@@ -450,7 +504,7 @@ grant codeBase "file:%s" {
  
      def start(self, wait=False, max_wait=60, timeout=None):
  
 -        cmd = ['systemctl', 'start', '%s.service' % self.service_name]
 +        cmd = ['/usr/sbin/service', self.rc_service_name, 'onestart']
          logger.debug('Command: %s', ' '.join(cmd))
          subprocess.check_call(cmd)
  
-@@ -490,7 +542,11 @@ grant codeBase "file:%s" {
+@@ -490,9 +544,24 @@ grant codeBase "file:%s" {
  
      def stop(self, wait=False, max_wait=60, timeout=None):
  
 -        cmd = ['systemctl', 'stop', '%s.service' % self.service_name]
 +        if not self.is_active():
 +            logger.info("PKI server already stopped")
 +            return
 +
 +        cmd = ['/usr/sbin/service', self.rc_service_name, 'onestop']
          logger.debug('Command: %s', ' '.join(cmd))
-         subprocess.check_call(cmd)
- 
-@@ -536,12 +592,17 @@ grant codeBase "file:%s" {
+-        subprocess.check_call(cmd)
++        # rc onestop relies on rc.subr wait_for_pids(), which blocks
++        # forever when the jsvc/JVM does not exit (e.g. a wedged webapp
++        # during pkidestroy). Bound it and fall back to SIGKILL so the
++        # caller never hangs indefinitely.
++        stop_timeout = timeout or max_wait
++        try:
++            subprocess.check_call(cmd, timeout=stop_timeout)
++        except subprocess.TimeoutExpired:
++            logger.warning(
++                '%s did not stop within %ss; sending SIGKILL',
++                self.rc_service_name, stop_timeout)
++            subprocess.call(['/bin/pkill', '-KILL', '-f', self.rc_service_name])
+ 
+         if not wait:
+             return
+@@ -536,12 +605,17 @@ grant codeBase "file:%s" {
          self.start(wait=wait, max_wait=max_wait, timeout=timeout)
  
      def enable(self):
 -        cmd = ['systemctl', 'enable', '%s.service' % self.service_name]
 +        cmd = ['/usr/sbin/service', self.rc_service_name, 'enable']
          logger.debug('Command: %s', ' '.join(cmd))
          subprocess.check_call(cmd)
  
      def disable(self):
 -        cmd = ['systemctl', 'disable', '%s.service' % self.service_name]
 +
 +        if not os.path.exists(self.rc_script):
 +            logger.info("PKI server already disabled")
 +            return
 +
 +        cmd = ['/usr/sbin/service', self.rc_service_name, 'disable']
          logger.debug('Command: %s', ' '.join(cmd))
          subprocess.check_call(cmd)
  
-@@ -581,16 +642,20 @@ grant codeBase "file:%s" {
+@@ -581,16 +655,20 @@ grant codeBase "file:%s" {
          for name in self.config:
              logger.debug('- %s: %s', name, self.config[name])
  
 -        prefix = []
 +        subprocess_kwargs = {}
  
 -        # by default run PKI server as systemd user
 +        # by default run PKI server as service user
          if not as_current_user:
  
              current_user = pwd.getpwuid(os.getuid()).pw_name
  
 -            # switch to systemd user if different from current user
 +            # switch to service user if different from current user
              if current_user != self.user:
 -                prefix.extend(['/usr/sbin/runuser', '-u', self.user, '--'])
 +                subprocess_kwargs.update({
 +                    'user': self.user,
 +                    'group': self.group,
 +                    'extra_groups': os.getgrouplist(self.user, self.gid)
 +                })
  
          java_home = self.config.get('JAVA_HOME')
          java_opts = self.config.get('JAVA_OPTS')
-@@ -599,12 +664,12 @@ grant codeBase "file:%s" {
+@@ -599,12 +677,12 @@ grant codeBase "file:%s" {
          classpath = [
              Tomcat.SHARE_DIR + '/bin/bootstrap.jar',
              Tomcat.SHARE_DIR + '/bin/tomcat-juli.jar',
 -            '/usr/share/java/ant.jar',
 -            '/usr/share/java/ant-launcher.jar',
 +            '/usr/local/share/java/apache-ant/lib/ant.jar',
 +            '/usr/local/share/java/apache-ant/lib/ant-launcher.jar',
              '/usr/lib/jvm/java/lib/tools.jar'
          ]
  
 -        cmd = prefix
 +        cmd = []
  
          if with_valgrind:
              cmd.extend(['valgrind', '--trace-children=yes', '--tool=massif'])
-@@ -618,7 +683,7 @@ grant codeBase "file:%s" {
+@@ -618,7 +696,7 @@ grant codeBase "file:%s" {
          else:
              cmd.extend([java_home + '/bin/java'])
  
 -            # add JVM options as in /etc/tomcat/conf.d/java-9-start-up-parameters.conf
 +            # add JVM options as in /usr/local/apache-tomcat-9.0/conf/conf.d/java-9-start-up-parameters.conf
              cmd.extend([
                  '--add-opens', 'java.base/java.lang=ALL-UNNAMED',
                  '--add-opens', 'java.base/java.io=ALL-UNNAMED',
-@@ -661,7 +726,7 @@ grant codeBase "file:%s" {
+@@ -661,7 +739,7 @@ grant codeBase "file:%s" {
  
          logger.debug('Command: %s', ' '.join(cmd))
  
 -        return subprocess.Popen(cmd, env=self.config)
 +        return subprocess.Popen(cmd, env=self.config, **subprocess_kwargs)
  
      def chown(self, path):
  
-@@ -787,8 +852,8 @@ grant codeBase "file:%s" {
+@@ -787,8 +865,8 @@ grant codeBase "file:%s" {
          self.create_logging_properties(exist_ok=True)
          self.create_web_xml(exist_ok=True)
  
 -        # copy /etc/tomcat/tomcat.conf
 -        # to /var/lib/pki/<instance>/conf/tomcat.conf
 +        # copy /usr/local/apache-tomcat-9.0/conf/tomcat.conf
 +        # to /var/db/pki/<instance>/conf/tomcat.conf
          self.copy(
              Tomcat.TOMCAT_CONF,
              self.tomcat_conf,
-@@ -798,7 +863,7 @@ grant codeBase "file:%s" {
+@@ -798,7 +876,7 @@ grant codeBase "file:%s" {
          tomcat_conf = pki.PropertyFile(self.tomcat_conf, quote='"')
          tomcat_conf.read()
  
 -        # store JAVA_HOME from /usr/share/pki/etc/pki.conf
 +        # store JAVA_HOME from /usr/local/share/pki/etc/pki.conf
          java_home = os.getenv('JAVA_HOME')
          tomcat_conf.set('JAVA_HOME', java_home)
  
-@@ -810,27 +875,21 @@ grant codeBase "file:%s" {
+@@ -810,27 +888,21 @@ grant codeBase "file:%s" {
  
          tomcat_conf.write()
  
 -        # copy /var/lib/pki/<instance>/conf/tomcat.conf
 -        # to /etc/sysconfig/<type>@<instance>
 -        self.copy(
 -            self.tomcat_conf,
 -            self.service_conf,
 -            exist_ok=True,
 -            force=force)
 +        self.create_rc_service(exist_ok=True)
  
      def create_conf_dir(self, exist_ok=False):
  
          if self._conf_dir:
  
 -            # Create /etc/pki/<instance>
 +            # Create /usr/local/etc/pki/<instance>
              self.makedirs(self._conf_dir, exist_ok=exist_ok)
  
 -            # Link /var/lib/pki/<instance>/conf to /etc/pki/<instance>
 +            # Link /var/db/pki/<instance>/conf to /usr/local/etc/pki/<instance>
              self.symlink(self._conf_dir, self.conf_dir, exist_ok=exist_ok)
  
              return
  
 -        # Create /var/lib/pki/<instance>/conf
 +        # Create /var/db/pki/<instance>/conf
          self.makedirs(self.conf_dir, exist_ok=exist_ok)
  
      def create_logs_dir(self, exist_ok=False):
-@@ -844,15 +903,15 @@ grant codeBase "file:%s" {
+@@ -844,15 +916,15 @@ grant codeBase "file:%s" {
              backup_dir = os.path.join(self._logs_dir, 'backup')
              self.makedirs(backup_dir, exist_ok=exist_ok)
  
 -            # Link /var/lib/pki/<instance>/logs to /var/log/pki/<instance>
 +            # Link /var/db/pki/<instance>/logs to /var/log/pki/<instance>
              self.symlink(self._logs_dir, self.logs_dir, exist_ok=exist_ok)
  
              return
  
 -        # Create /var/lib/pki/<instance>/logs
 +        # Create /var/db/pki/<instance>/logs
          self.makedirs(self.logs_dir, exist_ok=exist_ok)
  
 -        # Create /var/lib/pki/<instance>/logs/backup
 +        # Create /var/db/pki/<instance>/logs/backup
          backup_dir = os.path.join(self.logs_dir, 'backup')
          self.makedirs(backup_dir, exist_ok=exist_ok)
  
-@@ -868,8 +927,8 @@ grant codeBase "file:%s" {
+@@ -868,8 +940,8 @@ grant codeBase "file:%s" {
  
      def create_catalina_properties(self, exist_ok=False):
  
 -        # Link /var/lib/pki/<instance>/conf/catalina.properties
 -        # to /usr/share/pki/server/conf/catalina.properties.
 +        # Link /var/db/pki/<instance>/conf/catalina.properties
 +        # to /usr/local/share/pki/server/conf/catalina.properties.
  
          catalina_properties = os.path.join(
              PKIServer.SHARE_DIR, 'server', 'conf', 'catalina.properties')
-@@ -877,16 +936,16 @@ grant codeBase "file:%s" {
+@@ -877,16 +949,16 @@ grant codeBase "file:%s" {
  
      def create_context_xml(self, exist_ok=False):
  
 -        # Link /var/lib/pki/<instance>/conf/context.xml
 -        # to /etc/tomcat/context.xml.
 +        # Link /var/db/pki/<instance>/conf/context.xml
 +        # to /usr/local/apache-tomcat-9.0/conf/context.xml.
  
          context_xml = os.path.join(Tomcat.CONF_DIR, 'context.xml')
          self.symlink(context_xml, self.context_xml, exist_ok=exist_ok)
  
      def create_logging_properties(self, exist_ok=False):
  
 -        # Copy /etc/tomcat/logging.properties
 -        # to /var/lib/pki/<instance>/conf/logging.properties.
 +        # Copy /usr/local/apache-tomcat-9.0/conf/logging.properties
 +        # to /var/db/pki/<instance>/conf/logging.properties.
  
          logging_properties = os.path.join(Tomcat.CONF_DIR, 'logging.properties')
          self.copy(
-@@ -896,7 +955,7 @@ grant codeBase "file:%s" {
+@@ -896,7 +968,7 @@ grant codeBase "file:%s" {
  
      def create_server_xml(self, exist_ok=False):
  
 -        # Copy /etc/tomcat/server.xml to <instance>/conf/server.xml
 +        # Copy /usr/local/apache-tomcat-9.0/conf/server.xml to <instance>/conf/server.xml
  
          self.copy(
              pki.server.Tomcat.SERVER_XML,
-@@ -973,7 +1032,7 @@ grant codeBase "file:%s" {
+@@ -973,7 +1045,7 @@ grant codeBase "file:%s" {
                  self.makedirs(host_dir, exist_ok=exist_ok)
  
                  # Link <instance>/conf/<engine>/<host>/rewrite.config
 -                # to /usr/share/pki/server/conf/Catalina/localhost/rewrite.config
 +                # to /usr/local/share/pki/server/conf/Catalina/localhost/rewrite.config
  
                  link = os.path.join(host_dir, 'rewrite.config')
                  self.symlink(target, link, exist_ok=exist_ok)
-@@ -982,8 +1041,8 @@ grant codeBase "file:%s" {
+@@ -982,8 +1054,8 @@ grant codeBase "file:%s" {
  
      def create_web_xml(self, exist_ok=False):
  
 -        # Link /var/lib/pki/<instance>/conf/web.xml
 -        # to /etc/tomcat/web.xml.
 +        # Link /var/db/pki/<instance>/conf/web.xml
 +        # to /usr/local/apache-tomcat-9.0/conf/web.xml.
  
          self.symlink(
              os.path.join(Tomcat.CONF_DIR, 'web.xml'),
-@@ -1304,8 +1363,7 @@ grant codeBase "file:%s" {
+@@ -1304,8 +1376,7 @@ grant codeBase "file:%s" {
  
      def remove(self, remove_conf=False, remove_logs=False, force=False):
  
 -        logger.info('Removing %s', self.service_conf)
 -        pki.util.remove(self.service_conf, force=force)
 +        self.remove_rc_service(force=force)
  
          logger.info('Removing %s', self.work_dir)
          pki.util.rmtree(self.work_dir, force=force)
-@@ -1327,7 +1385,7 @@ grant codeBase "file:%s" {
+@@ -1327,7 +1398,7 @@ grant codeBase "file:%s" {
          logger.info('Removing %s', self.bin_dir)
          pki.util.unlink(self.bin_dir, force=force)
  
 -        # remove /var/lib/pki/<instance>/alias if exists
 +        # remove /var/db/pki/<instance>/alias if exists
          if os.path.islink(self.nssdb_link):
              logger.info('Removing %s', self.nssdb_link)
              pki.util.unlink(self.nssdb_link)
-@@ -1356,7 +1414,7 @@ grant codeBase "file:%s" {
+@@ -1356,7 +1427,7 @@ grant codeBase "file:%s" {
              # Get the actual folder in case it has changed
              _logs_dir = os.readlink(self.logs_dir)
  
 -            # Remove /var/lib/pki/<instance>/logs
 +            # Remove /var/db/pki/<instance>/logs
              logger.info('Removing %s', self.logs_dir)
              pki.util.unlink(self.logs_dir, force=force)
  
-@@ -1366,7 +1424,7 @@ grant codeBase "file:%s" {
+@@ -1366,7 +1437,7 @@ grant codeBase "file:%s" {
  
              return
  
 -        # Remove /var/lib/pki/<instance>/logs
 +        # Remove /var/db/pki/<instance>/logs
          logger.info('Removing %s', self.logs_dir)
          pki.util.rmtree(self.logs_dir, force=force)
  
-@@ -1377,17 +1435,17 @@ grant codeBase "file:%s" {
+@@ -1377,17 +1448,17 @@ grant codeBase "file:%s" {
              # Get the actual folder in case it has changed
              _conf_dir = os.readlink(self.conf_dir)
  
 -            # Remove /var/lib/pki/<instance>/conf
 +            # Remove /var/db/pki/<instance>/conf
              logger.info('Removing %s', self.conf_dir)
              pki.util.unlink(self.conf_dir, force=force)
  
 -            # Remove /etc/pki/<instance>
 +            # Remove /usr/local/etc/pki/<instance>
              logger.info('Removing %s', _conf_dir)
              pki.util.rmtree(_conf_dir, force=force)
  
              return
  
 -        # Remove /var/lib/pki/<instance>/conf
 +        # Remove /var/db/pki/<instance>/conf
          logger.info('Removing %s', self.conf_dir)
          pki.util.rmtree(self.conf_dir, force=force)
  
-@@ -1468,11 +1526,11 @@ grant codeBase "file:%s" {
+@@ -1468,11 +1539,11 @@ grant codeBase "file:%s" {
  
              subsystem_dir = os.path.join(self.base_dir, subsystem_name)
  
 -            # ensure /var/lib/pki/<instance>/<subsystem> exists
 +            # ensure /var/db/pki/<instance>/<subsystem> exists
              if not os.path.exists(subsystem_dir):
                  continue
  
 -            # ensure /var/lib/pki/<instance>/<subsystem> is not empty
 +            # ensure /var/db/pki/<instance>/<subsystem> is not empty
              # https://issues.redhat.com/browse/RHEL-21568
              if not os.listdir(subsystem_dir):
                  # Directory exists but it is empty
-@@ -2398,7 +2456,11 @@ class PKIServerFactory(object):
+@@ -2398,7 +2469,11 @@ class PKIServerFactory(object):
              instance_type = parts[0]
              instance_name = parts[1]
  
 -        sysconfig_file = os.path.join('/etc/sysconfig', instance_name)
 +        rc_service_name = "".join(
 +            char if char.isalnum() or char == "_" else "_"
 +            for char in "%s@%s" % (instance_type, instance_name))
 +
 +        sysconfig_file = os.path.join(RC_CONF_DIR, rc_service_name)
  
          if os.path.isfile(sysconfig_file):