From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@link38.eu>
To: development@lists.ipfire.org
Subject:
 Re: [PATCH 3/3] generate ECDSA certificate and key on existing installations
Date: Mon, 25 Sep 2017 18:08:54 +0200
Message-ID: <20170925180854.668c8350.peter.mueller@link38.eu>
In-Reply-To: <1506290876.2813.33.camel@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0053963533637493655=="
List-Id: <development.lists.ipfire.org>

--===============0053963533637493655==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello Michael,

> Hi,
>=20
> is this not better to just call the httpscert script? Avoids copying
> code.
Yes. Never repeat yourself, as they say...

Will develop a 2nd version.

Best regards,
Peter M=C3=BCller
>=20
> -Michael
>=20
> On Mon, 2017-09-04 at 20:23 +0200, Peter M=C3=BCller wrote:
> > Generate ECDSA certificate and key file on existing installations
> > via the update.sh script.
> >=20
> > This is required since Apache crashes if some Certificate(Key)File
> > directives point to non-existing files:
> >=20
> > Restarting Apache daemon...
> > Syntax error on line 17 of /etc/httpd/conf/vhosts.d/ipfire-interface-ssl.=
conf:
> > SSLCertificateFile: file '/etc/httpd/server-ecdsa.crt' does not exist or =
is empty
> >=20
> > Key generation only takes a few seconds even on legacy systems. Also
> > existing installations will then use ECDSA/RSA certificate dual-stack.
> >=20
> > Signed-off-by: Peter M=C3=BCller <peter.mueller(a)link38.eu>
> > ---
> > diff --git a/config/rootfiles/core/114/update.sh b/config/rootfiles/core/=
114/update.sh
> > index 6d7a10b5e..c5d945b21 100644
> > --- a/config/rootfiles/core/114/update.sh
> > +++ b/config/rootfiles/core/114/update.sh
> > @@ -60,6 +60,14 @@ rm -f /usr/sbin/htpasswd
> >  # Update Language cache
> >  /usr/local/bin/update-lang-cache
> > =20
> > +# Generate ECDSA certificate and key file to prevent Apache from crashin=
g on existing installations
> > +/usr/bin/openssl ecparam -genkey -name secp384r1 | openssl ec -out /etc/=
httpd/server-ecdsa.key
> > +/bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/op=
enssl \
> > +	req -new -key /etc/httpd/server-ecdsa.key -out /etc/httpd/server-ecdsa.=
csr
> > +/usr/bin/openssl x509 -req -days 999999 -sha256 -in \
> > +	/etc/httpd/server-ecdsa.csr -signkey /etc/httpd/server-ecdsa.key -out \
> > +	/etc/httpd/server-ecdsa.crt
> > +
> >  # Start services
> >  /etc/init.d/unbound start
> >  /etc/init.d/apache start =20


--===============0053963533637493655==--