Description of problem:
We changed the generation of the default certificate for FR because of this bug[1]. Now the generation of the default certificates is during systemd start radiusd. The problem is that bootstrap script is run during every start and it verifies these default certificates. When these certificates expire after 60days (for example user uses their own certificates but did not delete def. certificates in /etc/raddb/certs) the FR fails to start. This issue has affected the upgrade of FR as well - https://access.redhat.com/solutions/5767041

The possible solution:
- run bootstrap script only once and not during every systemd start (it could be a little bit tricky because bootstrap script is mentioned in the unit file)
- modify the bootstrap script
      - bootstrap script should stay in unit file, run during the start of FR
      - if there are one or more def. certificates (valid, invalid, expired) in /etc/raddb/certs, bootstrap should not generate/replace/remove/verify any of them
      - bootstrap script should generate all default certificates and dh if there are not any existing def. certificates in /etc/radd/certs
      - bootstrap script should verify def. certificates ONLY during generating of these certs 
 
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1672285

Version-Release number of selected component (if applicable):
freeradius-3.0.20-3
RHEL8.4


Steps to Reproduce:
1. systemctl start radiusd
2. wait for 60 days or change date on the system
cd /etc/raddb/certs
openssl x509 -in server.pem -noout -text | grep -e{Before,After}
date -s 'Jun 28 10:12:09 2021 GMT'

3. systemctl start radiusd

Actual results:
...
- Unit radiusd.service has begun starting up.
Jun 28 06:12:20 ci-vm-10-0-136-152.hosted.upshift.rdu2.redhat.com sh[5481]: C = FR, ST = Radius, L = Somewhere, O = Example Inc., emailAddress = admin, CN = Example Certificate Authority
Jun 28 06:12:20 ci-vm-10-0-136-152.hosted.upshift.rdu2.redhat.com sh[5481]: error 10 at 1 depth lookup: certificate has expired
Jun 28 06:12:20 ci-vm-10-0-136-152.hosted.upshift.rdu2.redhat.com sh[5481]: C = FR, ST = Radius, O = Example Inc., CN = Example Server Certificate, emailAddress = admin
Jun 28 06:12:20 ci-vm-10-0-136-152.hosted.upshift.rdu2.redhat.com sh[5481]: error 10 at 0 depth lookup: certificate has expired
Jun 28 06:12:20 ci-vm-10-0-136-152.hosted.upshift.rdu2.redhat.com sh[5481]: error server.pem: verification failed
Jun 28 06:12:20 ci-vm-10-0-136-152.hosted.upshift.rdu2.redhat.com sh[5481]: make: *** [Makefile:107: server.vrfy] Error 2
Jun 28 06:12:20 ci-vm-10-0-136-152.hosted.upshift.rdu2.redhat.com systemd[1]: radiusd.service: Control process exited, code=exited status=2
Jun 28 06:12:20 ci-vm-10-0-136-152.hosted.upshift.rdu2.redhat.com systemd[1]: radiusd.service: Failed with result 'exit-code'.
...

Expected results:
I am inclined to the first solution but the second is fine as well. In every case, the radiusd should be run smoothly. 

Additional info: