master
Files in /etc/ssl belong to root. ok deraadt
Do not hardcode the CRL lifetime for "ikectl revoke" to 365 days. This value is supposed to be configurable via ikeca.cnf.
Set "unique_subject = no" to allow renewing expired certificates. Without this, openssl throws an error when creating a second req for the same subject which leads to ikectl deleting the old cert without creating a new one.
man pages: add missing commas between subordinate and main clauses
Convert simple stuff in usr.sbin over to new imsgbuf_init behaviour
Add iked connection statistics for successful and failed connections, common error types and other events that help analyze errors in larger setups. The counters can be printed with 'ikectl show stats'.