Call daemon() before initializing crypto library

index 73c6aff..5b22c38 100644
@@ -916,23 +916,20 @@ do_persist_tuntap (const struct options *options)
  * Should we become a daemon?
  * Return true if we did it.
  */
-static bool
+bool
 possibly_become_daemon (const struct options *options)
 {
   bool ret = false;
   if (options->daemon)
     {
       ASSERT (!options->inetd);
-      if (daemon (options->cd_dir != NULL, options->log) < 0)
+      /* Don't chdir immediately, but the end of the init sequence, if needed */
+      if (daemon (1, options->log) < 0)
 	msg (M_ERR, "daemon() failed or unsupported");
       restore_signal_state ();
       if (options->log)
 	set_std_files_to_null (true);
 
-#if defined(ENABLE_PKCS11)
-      pkcs11_forkFixup ();
-#endif
-
       ret = true;
     }
   return ret;

@@ -1809,15 +1806,11 @@ do_deferred_options (struct context *c, const unsigned int found)
  * Possible hold on initialization
  */
 static bool
-do_hold (struct context *c)
+do_hold (void)
 {
 #ifdef ENABLE_MANAGEMENT
   if (management)
     {
-      /* if c is defined, daemonize before hold */
-      if (c && c->options.daemon && management_should_daemonize (management))
-	do_init_first_time (c);
-
       /* block until management hold is released */
       if (management_hold (management))
 	return true;

@@ -1867,7 +1860,7 @@ socket_restart_pause (struct context *c)
   c->persist.restart_sleep_seconds = 0;
 
   /* do managment hold on context restart, i.e. second, third, fourth, etc. initialization */
-  if (do_hold (NULL))
+  if (do_hold ())
     sec = 0;
 
   if (sec)

@@ -1886,7 +1879,7 @@ do_startup_pause (struct context *c)
   if (!c->first_time)
     socket_restart_pause (c);
   else
-    do_hold (NULL); /* do management hold on first context initialization */
+    do_hold (); /* do management hold on first context initialization */
 }
 
 /*

@@ -2743,7 +2736,7 @@ do_compute_occ_strings (struct context *c)
 static void
 do_init_first_time (struct context *c)
 {
-  if (c->first_time && !c->did_we_daemonize && !c->c0)
+  if (c->first_time && !c->c0)
     {
       struct context_0 *c0;
 

@@ -2758,12 +2751,9 @@ do_init_first_time (struct context *c)
       /* get --writepid file descriptor */
       get_pid_file (c->options.writepid, &c0->pid_state);
 
-      /* become a daemon if --daemon */
-      c->did_we_daemonize = possibly_become_daemon (&c->options);
-
-      /* should we disable paging? */
-      if (c->options.mlock && c->did_we_daemonize)
-	platform_mlockall (true);	/* call again in case we daemonized */
+      /* perform postponed chdir if --daemon */
+      if (c->did_we_daemonize && c->options.cd_dir == NULL)
+	platform_chdir("/");
 
       /* save process ID in a file */
       write_pid (&c0->pid_state);

@@ -3221,7 +3211,7 @@ open_management (struct context *c)
 	    }
 
 	  /* initial management hold, called early, before first context initialization */
-	  do_hold (c);
+	  do_hold ();
 	  if (IS_SIG (c))
 	    {
 	      msg (M_WARN, "Signal received from management interface, exiting");

index 5a1d1dc..d1908ed 100644
@@ -55,6 +55,8 @@ bool do_genkey (const struct options *options);
 
 bool do_persist_tuntap (const struct options *options);
 
+bool possibly_become_daemon (const struct options *options);
+
 void pre_setup (const struct options *options);
 
 void init_instance_handle_signals (struct context *c, const struct env_set *env, const unsigned int flags);

index fd87fc1..2f327f3 100644
@@ -229,6 +229,10 @@ openvpn_main (int argc, char *argv[])
 	  if (do_test_crypto (&c.options))
 	    break;
 	  
+	  /* become a daemon if --daemon */
+	  if (c.first_time)
+	    c.did_we_daemonize = possibly_become_daemon (&c.options);
+
 #ifdef ENABLE_MANAGEMENT
 	  /* open management subsystem */
 	  if (!open_management (&c))

index 3a15ef6..a1f13c5 100644
@@ -336,11 +336,6 @@ pkcs11_terminate () {
 	);
 }
 
-void
-pkcs11_forkFixup () {
-	pkcs11h_forkFixup ();
-}
-
 bool
 pkcs11_addProvider (
 	const char * const provider,

index 4261871..b49401c 100644
@@ -38,9 +38,6 @@ pkcs11_initialize (
 void
 pkcs11_terminate ();
 
-void
-pkcs11_forkFixup ();
-
 bool
 pkcs11_addProvider (
 	const char * const provider,