Description of problem:
Openswan created a clean NSS database at the first ipsec daemon start, but the database can not be used, and it needs to be recreated by certutil. This should be working out of the box.

Version-Release number of selected component (if applicable):
openswan-2.6.32-27.3.el6_5

How reproducible:
always

Steps to Reproduce:

[root@rhel6 ~]# rpm -q openswan
openswan-2.6.32-27.3.el6_5.x86_64
[root@rhel6 ~]# 
[root@rhel6 ~]# ls -la /etc/ipsec.d/
total 12
drwx------.  3 root root 4096 Apr 30 10:46 .
drwxr-xr-x. 82 root root 4096 Apr 30 10:46 ..
drwx------.  2 root root 4096 Apr 30 10:46 policies
[root@rhel6 ~]# 
[root@rhel6 ~]# service ipsec start
ipsec_setup: Starting Openswan IPsec U2.6.32/K2.6.32-431.1.2.el6.x86_64...
ipsec_setup: multiple ip addresses, using  192.168.100.60 on eth0
[root@rhel6 ~]# ls -la /etc/ipsec.d/
total 72
drwx------.  3 root root  4096 Apr 30 10:47 .
drwxr-xr-x. 82 root root  4096 Apr 30 10:46 ..
-rw-------.  1 root root 65536 Apr 30 10:47 cert8.db
-rw-------.  1 root root 16384 Apr 30 10:47 key3.db
drwx------.  2 root root  4096 Apr 30 10:46 policies
-rw-------.  1 root root 16384 Apr 30 10:47 secmod.db
[root@rhel6 ~]# 
[root@rhel6 ~]# certutil -K -d /etc/ipsec.d/
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
certutil: could not authenticate to token NSS Certificate DB.: SEC_ERROR_IO: An I/O error occurred during security authorization.
[root@rhel6 ~]# 
[root@rhel6 ~]# ipsec newhostkey --configdir /etc/ipsec.d --output /etc/ipsec.secrets --bits 4096 --random /dev/urandom
ipsec rsasigkey: key pair generation failed: "-8037"
[root@rhel6 ~]# 
[root@rhel6 ~]# ipsec showhostkey --list
ipsec showhostkey nss directory showhostkey: /etc/ipsec.d
ipsec showhostkey "/etc/ipsec.secrets" line 2: Modulus keyword not found where expected in RSA key
[root@rhel6 ~]# cat /etc/ipsec.secrets 
: RSA	{
	}
# do not change the indenting of that "}"
[root@rhel6 ~]# 
[root@rhel6 ~]# rm -f /etc/ipsec.d/cert8.db 
[root@rhel6 ~]# certutil -N -d /etc/ipsec.d/
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.

Enter new password: 
Re-enter password: 
[root@rhel6 ~]# certutil -K -d /etc/ipsec.d/
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
certutil: no keys found
[root@rhel6 ~]# 
[root@rhel6 ~]# ipsec newhostkey --configdir /etc/ipsec.d --output /etc/ipsec.secrets --bits 4096 --random /dev/urandom
Generated RSA key pair using the NSS database
[root@rhel6 ~]# certutil -K -d /etc/ipsec.d/
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
< 0> rsa      5e288cf023374b156566945386a5f803c2fe2835   (orphan)
[root@rhel6 ~]# certutil -L -d /etc/ipsec.d/

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

[root@rhel6 ~]# ipsec showhostkey --list
ipsec showhostkey nss directory showhostkey: /etc/ipsec.d
1(1): RSA keyid: AQOy2WVqU with id: (none)
1(2): RSA keyid: AQOy2WVqU with id: (none)
[root@rhel6 ~]# 


Actual results:
New keys can not be created.

Expected results:
New keys should be created.