Fix OpenSSL genpkey parameter formatting for SSL certificate generation

The OpenSSL genpkey command was failing with the error:
'Error setting rsa_keygen_bits: 2048 parameter'

This was caused by incorrect parameter formatting in the -pkeyopt
argument. The parameter 'rsa_keygen_bits: 2048' had a space after
the colon, but OpenSSL expects 'rsa_keygen_bits:2048' (no space).

This issue was introduced in commit 0b73535 when migrating from
genrsa to genpkey for FIPS compatibility.

Changes:
- Fixed the -pkeyopt parameter in certificate_generator.rb
- Updated the corresponding test expectation
- Added changelog entry

Testing:
Verified with OpenSSL command line:
  openssl genpkey -algorithm RSA -pass stdin -aes256 \
    -out /tmp/test.key -pkeyopt rsa_keygen_bits:2048
Successfully generates encrypted key with correct syntax.

Fixes: bsc#1266671
Related: bsc#1235462 (FIPS compatibility)

Author: ngetahun

package/yast2-rmt.changes

@@ -1,6 +1,7 @@
 -------------------------------------------------------------------
 Mon Sep  1 10:06:04 UTC 2025 - Natnael Getahun <natnael.getahun@suse.com>
 
+- Fix OpenSSL genpkey parameter formatting for SSL certificate generation (bsc#1266671)
 - Ensure compatibility with FIPS mode (bsc#1235462)
 - Remove 'Forward systems to SCC' checkbox (scc-262)
 - Fix ERB initialization for older Ruby versions (bsc#1146403)

spec/rmt/ssl/certificate_generator_spec.rb

@@ -161,7 +161,7 @@
         expect_any_instance_of(Cheetah::DefaultRecorder).not_to receive(:record_stdin)
         expect(RMT::Execute).to receive(:on_target!).with(
           'openssl', 'genpkey', '-algorithm', 'RSA', '-pass', 'stdin', '-aes256',
-          '-out', ssl_files[:ca_private_key], '-pkeyopt', "rsa_keygen_bits: #{described_class::OPENSSL_KEY_BITS}",
+          '-out', ssl_files[:ca_private_key], '-pkeyopt', "rsa_keygen_bits:#{described_class::OPENSSL_KEY_BITS}",
           stdin: ca_password,
           logger: nil
         )

src/lib/rmt/ssl/certificate_generator.rb

@@ -99,7 +99,7 @@ def generate(common_name, alt_names, ca_password)
 
       RMT::Execute.on_target!(
         'openssl', 'genpkey', '-algorithm', 'RSA', '-pass', 'stdin', '-aes256',
-        '-out', @ssl_paths[:ca_private_key], '-pkeyopt', "rsa_keygen_bits: #{OPENSSL_KEY_BITS}",
+        '-out', @ssl_paths[:ca_private_key], '-pkeyopt', "rsa_keygen_bits:#{OPENSSL_KEY_BITS}",
         stdin: ca_password,
         logger: nil # do not log in order to securely pass password
       )