Step to generate .p12 files fails with "unknown option '-legacy'" in openssl pkcs12 call

[DaveCole]

Describe the bug

In the near-last step to generate .p12 files, the following call fails:
openssl pkcs12 -legacy -in certs/phone.crt -inkey private/phone.key -export -name phone -out private/phone.p12 -passout pass:\\"<redacted>\\"\\n

With the following error:
unknown option '-legacy'

To Reproduce

Run on ./algo with default settings on Mac OS 15.2 Sequoia -> Digital Ocean

[jackivanov]

I can't reproduce on 15.2

[DaveCole]

Hmm. The only additional info I can think to provide was that this was on the Toronto server for Digital Ocean. Not sure it matters but I also updated locally to the most recent stable version of Python & PIP. I also tweaked the config to set unattended_reboot.enabled: true and changed the users to phone, laptop, and ipad

[demidovsky]

Had the same issue. Seems that this is not related to the OS version but rather the openssl version.
I guess in some cases it is not detected correctly, causing the extra -legacy param to appear.

WORKAROUND:
simply removing two {{ (openssl_version is version('3', '>=')) | ternary('-legacy', '') }} lines from roles/strongswan/tasks/openssl.yml did the trick.