From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH 3/3] generate ECDSA certificate and key on existing installations Date: Mon, 04 Sep 2017 20:23:05 +0200 Message-ID: <20170904202305.28c45ae6.peter.mueller@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1649030124093280281==" List-Id: --===============1649030124093280281== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Generate ECDSA certificate and key file on existing installations via the update.sh script. This is required since Apache crashes if some Certificate(Key)File directives point to non-existing files: Restarting Apache daemon... Syntax error on line 17 of /etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf: SSLCertificateFile: file '/etc/httpd/server-ecdsa.crt' does not exist or is e= mpty Key generation only takes a few seconds even on legacy systems. Also existing installations will then use ECDSA/RSA certificate dual-stack. Signed-off-by: Peter M=C3=BCller --- diff --git a/config/rootfiles/core/114/update.sh b/config/rootfiles/core/114/= update.sh index 6d7a10b5e..c5d945b21 100644 --- a/config/rootfiles/core/114/update.sh +++ b/config/rootfiles/core/114/update.sh @@ -60,6 +60,14 @@ rm -f /usr/sbin/htpasswd # Update Language cache /usr/local/bin/update-lang-cache =20 +# Generate ECDSA certificate and key file to prevent Apache from crashing on= existing installations +/usr/bin/openssl ecparam -genkey -name secp384r1 | openssl ec -out /etc/http= d/server-ecdsa.key +/bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/openss= l \ + req -new -key /etc/httpd/server-ecdsa.key -out /etc/httpd/server-ecdsa.csr +/usr/bin/openssl x509 -req -days 999999 -sha256 -in \ + /etc/httpd/server-ecdsa.csr -signkey /etc/httpd/server-ecdsa.key -out \ + /etc/httpd/server-ecdsa.crt + # Start services /etc/init.d/unbound start /etc/init.d/apache start --===============1649030124093280281==--