From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH v2 3/3] generate ECDSA certificate and key on existing installations Date: Wed, 04 Oct 2017 21:38:20 +0200 Message-ID: <20171004213820.125b7aae.peter.mueller@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3546181909240010330==" List-Id: --===============3546181909240010330== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Generate ECDSA certificate and key file on existing installations via the update.sh script. This is required since Apache crashes if some Certificate(Key)File directives point to non-existing files: Restarting Apache daemon... Syntax error on line 17 of /etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf: SSLCertificateFile: file '/etc/httpd/server-ecdsa.crt' does not exist or is e= mpty Key generation only takes a few seconds even on legacy systems. Also existing installations will then use ECDSA/RSA certificate dual-stack. Changes from v1: Use the httpscert script (never repeat yourself) and restart Apache afterwards to load the changes. Signed-off-by: Peter M=C3=BCller --- diff --git a/config/rootfiles/core/115/update.sh b/config/rootfiles/core/115/= update.sh index e0ee121ce..afeeca14a 100644 --- a/config/rootfiles/core/115/update.sh +++ b/config/rootfiles/core/115/update.sh @@ -35,6 +35,7 @@ done openvpnctrl -k openvpnctrl -kn2n =20 + # Extract files extract_files =20 @@ -44,10 +45,13 @@ ldconfig # Update Language cache #/usr/local/bin/update-lang-cache =20 +# generate ECDSA certificate and key file to prevent Apache from crashing on= existing installations +/usr/local/bin/httpscert + # Start services openvpnctrl -s openvpnctrl -sn2n - +/etc/init.d/apache restart =20 # This update need a reboot... #touch /var/run/need_reboot --===============3546181909240010330==--