[PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Vincent Li <vincent.mc.li@gmail.com>]

After completing an ISO installation, Apache was observed once to fail
to start, leaving the web UI inaccessible.  Although this is a rare
occurrence, the cause was that generate_certificates() used "test -f",
which only checks that the key/CSR/cert files exist, not that they are
non-empty.  If openssl fails to write a file during first boot (e.g.
low entropy) but leaves an empty file behind, later starts consider the
certificate already generated and skip regeneration, leaving Apache
with empty server-ecdsa.key/crt and a broken web UI.

Use "test -s" instead so empty files are regenerated, and log a boot
message via boot_mesg ${FAILURE} if a file is still empty after
openssl runs.

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
---
 src/initscripts/system/apache | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
index ba7ede670..7eba99b53 100644
--- a/src/initscripts/system/apache
+++ b/src/initscripts/system/apache
@@ -24,28 +24,38 @@
 
 PIDFILE="/var/run/httpd.pid"
 
+# Verify a generated file exists and is non-empty; log a boot message if not.
+check_generated() {
+	if [ ! -s "$1" ]; then
+		boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
+	fi
+}
+
 generate_certificates() {
-	if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
 		boot_mesg "Generating HTTPS ECDSA server key..."
 		openssl ecparam -genkey -name secp384r1 -noout \
 			-out /etc/httpd/server-ecdsa.key &>/dev/null
 		chmod 600 /etc/httpd/server-ecdsa.key
 		evaluate_retval
+		check_generated /etc/httpd/server-ecdsa.key
 	fi
 
-	if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
 		sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
 			openssl req -new -key /etc/httpd/server-ecdsa.key \
 			-out /etc/httpd/server-ecdsa.csr &>/dev/null
+		check_generated /etc/httpd/server-ecdsa.csr
 	fi
 
-	if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
 		boot_mesg "Signing ECDSA certificate..."
 		openssl x509 -req -days 999999 -sha256 \
 			-in /etc/httpd/server-ecdsa.csr \
 			-signkey /etc/httpd/server-ecdsa.key \
 			-out /etc/httpd/server-ecdsa.crt &>/dev/null
 		evaluate_retval
+		check_generated /etc/httpd/server-ecdsa.crt
 	fi
 }
 
-- 
2.34.1