From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: [PATCH 3/3] generate ECDSA certificate and key on existing installations Date: Sun, 24 Sep 2017 23:07:56 +0100 Message-ID: <1506290876.2813.33.camel@ipfire.org> In-Reply-To: <20170904202305.28c45ae6.peter.mueller@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6426162633689302934==" List-Id: --===============6426162633689302934== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, is this not better to just call the httpscert script? Avoids copying code. -Michael On Mon, 2017-09-04 at 20:23 +0200, Peter M=C3=BCller wrote: > Generate ECDSA certificate and key file on existing installations > via the update.sh script. >=20 > This is required since Apache crashes if some Certificate(Key)File > directives point to non-existing files: >=20 > Restarting Apache daemon... > Syntax error on line 17 of /etc/httpd/conf/vhosts.d/ipfire-interface-ssl.co= nf: > SSLCertificateFile: file '/etc/httpd/server-ecdsa.crt' does not exist or is= empty >=20 > Key generation only takes a few seconds even on legacy systems. Also > existing installations will then use ECDSA/RSA certificate dual-stack. >=20 > Signed-off-by: Peter M=C3=BCller > --- > diff --git a/config/rootfiles/core/114/update.sh b/config/rootfiles/core/11= 4/update.sh > index 6d7a10b5e..c5d945b21 100644 > --- a/config/rootfiles/core/114/update.sh > +++ b/config/rootfiles/core/114/update.sh > @@ -60,6 +60,14 @@ rm -f /usr/sbin/htpasswd > # Update Language cache > /usr/local/bin/update-lang-cache > =20 > +# Generate ECDSA certificate and key file to prevent Apache from crashing = on existing installations > +/usr/bin/openssl ecparam -genkey -name secp384r1 | openssl ec -out /etc/ht= tpd/server-ecdsa.key > +/bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/open= ssl \ > + req -new -key /etc/httpd/server-ecdsa.key -out /etc/httpd/server-ecdsa.csr > +/usr/bin/openssl x509 -req -days 999999 -sha256 -in \ > + /etc/httpd/server-ecdsa.csr -signkey /etc/httpd/server-ecdsa.key -out \ > + /etc/httpd/server-ecdsa.crt > + > # Start services > /etc/init.d/unbound start > /etc/init.d/apache start --===============6426162633689302934== Content-Type: application/pgp-signature Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="signature.asc" MIME-Version: 1.0 LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUFCQ2dBZEZpRUU1L3JXNWwzR0dl Mnlwa3R4Z0hudy8yK1FDUWNGQWxuSUxMMEFDZ2tRZ0hudy8yK1EKQ1FmaC9CQUFwMldKaDZDWjgr WGM5MHY2a2FKVTVGWWxmcWM1b0hlK0oxU2xRY01aeGo4NWVJdDM1SVVkUzlKYQoyOEFOdi9Fem5s SW9tekFiMDJPVkdCaldwTWFEaHJpU1BQM3NjczhVT2tkWVNmemZXNXBpTWhrYnFHelJVbS9lClQv anA4RStnR2ExWUJSRURLT01RL0RQdTBsalJJTElnTHdYK3FSdHJpMENQcEx5N0poeVpvdUJRSjN1 bWZuOUMKVVNkTVRVYzRJcUVLS3BYTGxENTVDK1dld2lkV1o1Z1FsN1dpYWxqZDFxbnVTTW5DMjNx U1FUTzFtOG5aUU4xNgpaNVZVeHRZYXdwSzhwQlBSZXhnMVY4TkFwK3h2L3NaKzhyMHc1Ulo1aktN b3BXYkhlOWdEdkc2WEtIbGNlVVdECmEzbm1BTjAyZHNwbi80emNjRzRzdm92WEh5Ulh0RFJWRGVG bVlxWDJxbklrZXpSWnpuVk5zMTVzRlorN3BvRUwKalI0Wk84YzY3RjVRSlNJZ1dSTjdTSHBOOUtm RmNsYitRSUdQZjM1bG8xVkhCc0xod2lRQlI5SUdmWHhESXBpNwpHdDhxbGx0OTFKV21NTlRRMGdk Z0tlOXM1ZFlJK0hJK0RxaGt0aFdRamo3dWt0aGYyM09UZW5PRHYrTHdJbVYyCmdONEdrUCt3OGoz K1M2M3FmWHNuMGNReDB3M0cvam1LbzZGQ3hwdHBrVERxNWJqV0d1Rk5yWDFmMEJPKzI5K2YKNVlV c3FiRnB0NDM2c1FaemZFbmZwT3E3YVpNbUlrYi9ubDFPaUNUd29XVzhUdUZJOWFSbk1wd3JMSTk4 VmVNeQpnUW03V0M2cG13SnpueS8xWnliTlVTRU44L0t4R3JkeGR3R1cxOHF5b3Q0SlNlS3hxREU9 Cj1FN2pDCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo= --===============6426162633689302934==--