diff --git a/.gitignore b/.gitignore
index 2a06a22..2f5a9d8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,3 +33,4 @@ freeradius-*.src.rpm
 /freeradius-server-3.0.18.tar.bz2
 /freeradius-server-3.0.19.tar.bz2
 /freeradius-server-3.0.20.tar.bz2
+/freeradius-server-3.0.21.tar.bz2
diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch
index 7af7c94..17cab04 100644
--- a/freeradius-bootstrap-create-only.patch
+++ b/freeradius-bootstrap-create-only.patch
@@ -1,36 +1,18 @@
-From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001
+From acaf4be8e301a01041acba189194d9502994611d Mon Sep 17 00:00:00 2001
 From: Alexander Scheel <ascheel@redhat.com>
-Date: Wed, 8 May 2019 10:29:08 -0400
+Date: Wed, 13 May 2020 10:01:47 -0400
 Subject: [PATCH] Don't clobber existing files on bootstrap
 
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
- raddb/certs/bootstrap | 39 ++++++++++++---------------------------
- 1 file changed, 12 insertions(+), 27 deletions(-)
+ raddb/certs/bootstrap | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)
 
 diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
-index 0f719aafd4..be81a2d697 100755
+index ede09bc..e555491 100755
 --- a/raddb/certs/bootstrap
 +++ b/raddb/certs/bootstrap
-@@ -13,17 +13,6 @@
- umask 027
- cd `dirname $0`
-
--make -h > /dev/null 2>&1
--
--#
--#  If we have a working "make", then use it.  Otherwise, run the commands
--#  manually.
--#
--if [ "$?" = "0" ]; then
--  make all
--  exit $?
--fi
--
- #
- #  The following commands were created by running "make -n", and edited
- #  to remove the trailing backslash, and to add "exit 1" after the commands.
-@@ -31,52 +20,51 @@ fi
+@@ -20,56 +20,55 @@ cd `dirname $0`
  #  Don't edit the following text.  Instead, edit the Makefile, and
  #  re-generate these commands.
  #
@@ -44,60 +26,64 @@ index 0f719aafd4..be81a2d697 100755
 -  fi
 +  ln -sf /dev/urandom random
  fi
-
+ 
 -if [ ! -f server.key ]; then
 +if [ ! -e server.key ]; then
    openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
+   chmod g+r server.key
  fi
-
+ 
 -if [ ! -f ca.key ]; then
 +if [ ! -e ca.key ]; then
    openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
  fi
-
+ 
 -if [ ! -f index.txt ]; then
 +if [ ! -e index.txt ]; then
    touch index.txt
  fi
-
+ 
 -if [ ! -f serial ]; then
 +if [ ! -e serial ]; then
    echo '01' > serial
  fi
-
+ 
 -if [ ! -f server.crt ]; then
 +if [ ! -e server.crt ]; then
    openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
  fi
-
+ 
 -if [ ! -f server.p12 ]; then
 +if [ ! -e server.p12 ]; then
    openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+   chmod g+r server.p12
  fi
-
+ 
 -if [ ! -f server.pem ]; then
 +if [ ! -e server.pem ]; then
    openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
    openssl verify -CAfile ca.pem server.pem || exit 1
+   chmod g+r server.pem
  fi
-
+ 
 -if [ ! -f ca.der ]; then
 +if [ ! -e ca.der ]; then
    openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
  fi
-
+ 
 -if [ ! -f client.key ]; then
 +if [ ! -e client.key ]; then
    openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+   chmod g+r client.key
  fi
-
+ 
 -if [ ! -f client.crt ]; then
 +if [ ! -e client.crt ]; then
    openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
  fi
 +
 +chown root:radiusd dh ca.* client.* server.*
-+chmod 644 dh ca.* client.* server.*
---
-2.21.0
++chmod 640 dh ca.* client.* server.*
+-- 
+2.26.2
 
diff --git a/freeradius.spec b/freeradius.spec
index 7658dee..2c3c0ed 100644
--- a/freeradius.spec
+++ b/freeradius.spec
@@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.0.20
-Release: 1%{?dist}
+Version: 3.0.21
+Release: 2%{?dist}
 License: GPLv2+ and LGPLv2+
 URL: http://www.freeradius.org/
 
@@ -208,23 +208,19 @@ This plugin provides the REST support for the FreeRADIUS server project.
 # Force compile/link options, extra security for network facing daemon
 %global _hardened_build 1
 
+%if 0%{?fedora} <= 30
+# Hack: rlm_python3 as stable; prevents building other unstable modules.
+echo rlm_python3 >> src/modules/stable
+%else
 # Hack: rlm_python3 as stable; prevents building other unstable modules.
 sed 's/rlm_python/rlm_python3/g' src/modules/stable -i
+%endif
 
 # python3-config is broken:
 # https://bugzilla.redhat.com/show_bug.cgi?id=1772988
 export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')"
 export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')"
 
-# Hack: rlm_python3 configure.ac script is broken because it doesn't
-# respect --with-rlm-python3-include-dir.
-sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try_dir=$PY_INC_DIR#g' src/modules/rlm_python3/configure.ac
-
-# In order for the above hack to stick, do a fake configure so
-# we can run reconfig before cleaning up after ourselves and running
-# configure for real.
-./configure && make reconfig && (make clean distclean || true)
-
 %configure \
         --libdir=%{_libdir}/freeradius \
         --enable-reproducible-builds \
@@ -280,6 +276,7 @@ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/
 
 # remove unneeded stuff
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt
+rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.csr
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.der
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.key
@@ -298,6 +295,7 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/freeradius/*.la
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/mssql
 
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/oracle
+rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/mssql
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool-dhcp/oracle
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/oracle
 rm -r $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/moonshot-targeted-ids
@@ -756,6 +754,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/process-radacct.sql
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras/wimax
@@ -789,6 +788,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/process-radacct.sql
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf
@@ -818,6 +818,8 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-refresh.sh
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql
 
 %{_libdir}/freeradius/rlm_sql_sqlite.so
 
@@ -833,6 +835,14 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
 %changelog
+* Wed May 13 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-2
+- Fix certificate generation
+  Resolves: bz#1835249
+
+* Tue Apr 07 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-1
+- Rebased to 3.0.21
+  Resolves: bz#1816745
+
 * Fri Nov 15 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.20-1
 - Rebased to 3.0.20
   Resolves: bz#1772710
diff --git a/sources b/sources
index ab35246..a895a5a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (freeradius-server-3.0.20.tar.bz2) = d5e0732a75268480092b46822a0e0fffb683adb93be13932eb170d2dc783a46d0daff4cadd0de69fd5ce4578083c9f69a9cccc485ea9c0c2eecf82c772f54b8e
+SHA512 (freeradius-server-3.0.21.tar.bz2) = 18cc142caad2143e30bc54242e3824b5f659f2f6e8f3401c71ce3b9063de0bd8d206d84822c4ad1d99457dfd7121333d4accd0c8340fcfc6b33b8fbe24a31729