diff --git a/security/easy-rsa/Makefile b/security/easy-rsa/Makefile
index 621d400b5700..9eda71b01c86 100644
--- a/security/easy-rsa/Makefile
+++ b/security/easy-rsa/Makefile
@@ -1,56 +1,56 @@
 PORTNAME=	easy-rsa
 DISTVERSION=	3.2.1
-PORTREVISION=	2
+PORTREVISION=	3
 PORTEPOCH=	1
 CATEGORIES=	security net-mgmt
 MASTER_SITES=	https://github.com/OpenVPN/easy-rsa/releases/download/v${DISTVERSION}/ \
 		LOCAL/mandree/ \
 		https://github.com/OpenVPN/easy-rsa/raw/refs/tags/v${DISTVERSION}/dev/:lib
 DISTFILES=	${EXTRACT_ONLY} easyrsa-tools.lib:lib
 EXTRACT_ONLY=	EasyRSA-${DISTVERSION}${EXTRACT_SUFX}
 
 MAINTAINER=	mandree@FreeBSD.org
 COMMENT=	Small RSA key management package based on openssl
 WWW=		https://github.com/OpenVPN/easy-rsa
 
 LICENSE=	GPLv2
 
 USES=		tar:tgz
 
 PATCH_STRIP=	-p1
 
 NO_ARCH=	yes
 NO_BUILD=	yes
 
 SUB_FILES=	pkg-message
 
 WRKSRC=		${WRKDIR}/EasyRSA-${DISTVERSION}
 
 PORTDATA=	x509-types/
 _pd_files=	ChangeLog COPYING.md README.md README.quickstart.md mktemp.txt
 _pd_dirs=	doc/
 PORTDOCS=	${_pd_dirs} ${_pd_files}
 
 OPTIONS_DEFINE=	DOCS EXAMPLES
 
 do-install:
 		${MKDIR} ${STAGEDIR}${PREFIX}/bin
 		${MKDIR} ${STAGEDIR}${DATADIR}/x509-types/
 		${INSTALL_SCRIPT} ${WRKSRC}/easyrsa ${STAGEDIR}${PREFIX}/bin/
 		${INSTALL_SCRIPT} ${DISTDIR}/easyrsa-tools.lib ${STAGEDIR}${PREFIX}/bin/
 		${LN} -fh ${STAGEDIR}${PREFIX}/bin/easyrsa ${STAGEDIR}${PREFIX}/bin/easy-rsa
 		${INSTALL_DATA} ${WRKSRC}/vars.example ${STAGEDIR}${DATADIR}/
 		${INSTALL_DATA} ${WRKSRC}/openssl-easyrsa.cnf ${STAGEDIR}${DATADIR}/openssl-easyrsa.cnf.example
 		(cd ${WRKSRC}/x509-types/ && ${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}/x509-types/)
 
 do-install-DOCS-on:
 		${MKDIR} ${STAGEDIR}${DOCSDIR}
 .for i in ${_pd_files}
 		${INSTALL_DATA} ${WRKSRC}/${i} ${STAGEDIR}${DOCSDIR}
 .endfor
 .for i in ${_pd_dirs}
 		${MKDIR} ${STAGEDIR}${DOCSDIR}/${i}
 		(cd ${WRKSRC}/${i} && ${COPYTREE_SHARE} . ${STAGEDIR}${DOCSDIR}/${i})
 .endfor
 
 .include <bsd.port.mk>
diff --git a/security/easy-rsa/files/pkg-message.in b/security/easy-rsa/files/pkg-message.in
index 698bf9ad17fb..2efeed9ffba5 100644
--- a/security/easy-rsa/files/pkg-message.in
+++ b/security/easy-rsa/files/pkg-message.in
@@ -1,15 +1,33 @@
 
 NOTE: easyrsa will require you to initialize a PKI upon first use.
 
 ONLY for the very first run for a new PKI, do something such as this,
 assuming you will have its data in $HOME/my_new_pki:
 
   easyrsa --pki-dir=$HOME/my_new_pki init-pki # DANGEROUS - DESTROYS ~/my_new_pki
 
 See %%PREFIX%%/share/doc/easy-rsa/README.quickstart.md for further information.
 
 An on-line help is available, you can run:
 
   easyrsa help          # for help on commands
   easyrsa help options  # for help on options
 
+**** SECURITY WARNING FOR PAST security/easy-rsa versions ****
+**** easyrsa may have encrypted your CA private key with a weak cipher
+
+Per CVE-2024-13454, Easy-RSA 3.0.5 inclusively up to and including 3.1.7,
+when used with OpenSSL 3, may have accidentally encrypted the CA private
+key with a weak cipher, des-ede3-cbc, instead of the intended aes-256-cbc,
+when a CA was created with the   easyrsa build-ca   command.
+
+Such mistakes cannot be corrected by upgrading Easy-RSA alone.
+
+The standing recommendation for CA private keys is to 
+re-encrypt the CA privat keys with the aes-256-cbc cipher,
+by using the   easyrsa set-pass ca   command.
+
+For details, see https://community.openvpn.net/openvpn/wiki/CVE-2024-13454.
+
+**** END SECURITY WARNING FOR PAST security/easy-rsa versions ****
+
diff --git a/security/easy-rsa/pkg-message b/security/easy-rsa/pkg-message
deleted file mode 100644
index 4878550b10ba..000000000000
--- a/security/easy-rsa/pkg-message
+++ /dev/null
@@ -1,19 +0,0 @@
-
-**** SECURITY WARNING FOR PAST security/easy-rsa versions ****
-**** easyrsa may have encrypted your CA private key with a weak cipher
-
-Per CVE-2024-13454, Easy-RSA 3.0.5 inclusively up to and including 3.1.7,
-when used with OpenSSL 3, may have accidentally encrypted the CA private
-key with a weak cipher, des-ede3-cbc, instead of the intended aes-256-cbc,
-when a CA was created with the   easyrsa build-ca   command.
-
-Such mistakes cannot be corrected by upgrading Easy-RSA alone.
-
-The standing recommendation for CA private keys is to 
-re-encrypt the CA privat keys with the aes-256-cbc cipher,
-by using the   easyrsa set-pass ca   command.
-
-For details, see https://community.openvpn.net/openvpn/wiki/CVE-2024-13454.
-
-**** END SECURITY WARNING FOR PAST security/easy-rsa versions ****
-