[PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Vincent Li]

After completing an ISO installation, Apache was observed once to fail
to start, leaving the web UI inaccessible.  Although this is a rare
occurrence, the cause was that generate_certificates() used "test -f",
which only checks that the key/CSR/cert files exist, not that they are
non-empty.  If openssl fails to write a file during first boot (e.g.
low entropy) but leaves an empty file behind, later starts consider the
certificate already generated and skip regeneration, leaving Apache
with empty server-ecdsa.key/crt and a broken web UI.

Use "test -s" instead so empty files are regenerated, and log a boot
message via boot_mesg ${FAILURE} if a file is still empty after
openssl runs.

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
---
 src/initscripts/system/apache | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
index ba7ede670..7eba99b53 100644
--- a/src/initscripts/system/apache
+++ b/src/initscripts/system/apache
@@ -24,28 +24,38 @@
 
 PIDFILE="/var/run/httpd.pid"
 
+# Verify a generated file exists and is non-empty; log a boot message if not.
+check_generated() {
+	if [ ! -s "$1" ]; then
+		boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
+	fi
+}
+
 generate_certificates() {
-	if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
 		boot_mesg "Generating HTTPS ECDSA server key..."
 		openssl ecparam -genkey -name secp384r1 -noout \
 			-out /etc/httpd/server-ecdsa.key &>/dev/null
 		chmod 600 /etc/httpd/server-ecdsa.key
 		evaluate_retval
+		check_generated /etc/httpd/server-ecdsa.key
 	fi
 
-	if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
 		sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
 			openssl req -new -key /etc/httpd/server-ecdsa.key \
 			-out /etc/httpd/server-ecdsa.csr &>/dev/null
+		check_generated /etc/httpd/server-ecdsa.csr
 	fi
 
-	if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
 		boot_mesg "Signing ECDSA certificate..."
 		openssl x509 -req -days 999999 -sha256 \
 			-in /etc/httpd/server-ecdsa.csr \
 			-signkey /etc/httpd/server-ecdsa.key \
 			-out /etc/httpd/server-ecdsa.crt &>/dev/null
 		evaluate_retval
+		check_generated /etc/httpd/server-ecdsa.crt
 	fi
 }
 
-- 
2.34.1

Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Michael Tremer]

Hello Vincent,

Thank you very much for your email.

I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem.

All the best,
-Michael

> On 27 Oct 2026, at 06:36, Vincent Li <vincent.mc.li@gmail.com> wrote:
> 
> After completing an ISO installation, Apache was observed once to fail
> to start, leaving the web UI inaccessible.  Although this is a rare
> occurrence, the cause was that generate_certificates() used "test -f",
> which only checks that the key/CSR/cert files exist, not that they are
> non-empty.  If openssl fails to write a file during first boot (e.g.
> low entropy) but leaves an empty file behind, later starts consider the
> certificate already generated and skip regeneration, leaving Apache
> with empty server-ecdsa.key/crt and a broken web UI.
> 
> Use "test -s" instead so empty files are regenerated, and log a boot
> message via boot_mesg ${FAILURE} if a file is still empty after
> openssl runs.
> 
> Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
> ---
> src/initscripts/system/apache | 16 +++++++++++++---
> 1 file changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
> index ba7ede670..7eba99b53 100644
> --- a/src/initscripts/system/apache
> +++ b/src/initscripts/system/apache
> @@ -24,28 +24,38 @@
> 
> PIDFILE="/var/run/httpd.pid"
> 
> +# Verify a generated file exists and is non-empty; log a boot message if not.
> +check_generated() {
> + if [ ! -s "$1" ]; then
> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
> + fi
> +}
> +
> generate_certificates() {
> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
> boot_mesg "Generating HTTPS ECDSA server key..."
> openssl ecparam -genkey -name secp384r1 -noout \
> -out /etc/httpd/server-ecdsa.key &>/dev/null
> chmod 600 /etc/httpd/server-ecdsa.key
> evaluate_retval
> + check_generated /etc/httpd/server-ecdsa.key
> fi
> 
> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
> openssl req -new -key /etc/httpd/server-ecdsa.key \
> -out /etc/httpd/server-ecdsa.csr &>/dev/null
> + check_generated /etc/httpd/server-ecdsa.csr
> fi
> 
> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
> boot_mesg "Signing ECDSA certificate..."
> openssl x509 -req -days 999999 -sha256 \
> -in /etc/httpd/server-ecdsa.csr \
> -signkey /etc/httpd/server-ecdsa.key \
> -out /etc/httpd/server-ecdsa.crt &>/dev/null
> evaluate_retval
> + check_generated /etc/httpd/server-ecdsa.crt
> fi
> }
> 
> -- 
> 2.34.1
> 
> 

Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Vincent Li]

[-- Attachment #1: Type: text/plain, Size: 3638 bytes --]


Hi Michael,

This has happened to me only once. It occurred after completing the 
network setup during an ISO installation: the machine started all 
services, but during this period it appeared to hang and stopped 
responding. I had to power-reset the machine. After it booted up again, 
all services started fine except Apache, which reported a cert/key error. 
When I logged in, I found that the cert/key/csr files existed but were 
empty.

I don't know the exact reason why the cert/key/csr ended up empty during 
the first boot — perhaps the hang interrupted OpenSSL while it was in the 
middle of generating the cert/key, or something similar.

On Tue, 27 Oct 2026, Michael Tremer wrote:

> Hello Vincent,
>
> Thank you very much for your email.
>
> I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem.
>
> All the best,
> -Michael
>
>> On 27 Oct 2026, at 06:36, Vincent Li <vincent.mc.li@gmail.com> wrote:
>>
>> After completing an ISO installation, Apache was observed once to fail
>> to start, leaving the web UI inaccessible.  Although this is a rare
>> occurrence, the cause was that generate_certificates() used "test -f",
>> which only checks that the key/CSR/cert files exist, not that they are
>> non-empty.  If openssl fails to write a file during first boot (e.g.
>> low entropy) but leaves an empty file behind, later starts consider the
>> certificate already generated and skip regeneration, leaving Apache
>> with empty server-ecdsa.key/crt and a broken web UI.
>>
>> Use "test -s" instead so empty files are regenerated, and log a boot
>> message via boot_mesg ${FAILURE} if a file is still empty after
>> openssl runs.
>>
>> Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
>> ---
>> src/initscripts/system/apache | 16 +++++++++++++---
>> 1 file changed, 13 insertions(+), 3 deletions(-)
>>
>> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
>> index ba7ede670..7eba99b53 100644
>> --- a/src/initscripts/system/apache
>> +++ b/src/initscripts/system/apache
>> @@ -24,28 +24,38 @@
>>
>> PIDFILE="/var/run/httpd.pid"
>>
>> +# Verify a generated file exists and is non-empty; log a boot message if not.
>> +check_generated() {
>> + if [ ! -s "$1" ]; then
>> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
>> + fi
>> +}
>> +
>> generate_certificates() {
>> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
>> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
>> boot_mesg "Generating HTTPS ECDSA server key..."
>> openssl ecparam -genkey -name secp384r1 -noout \
>> -out /etc/httpd/server-ecdsa.key &>/dev/null
>> chmod 600 /etc/httpd/server-ecdsa.key
>> evaluate_retval
>> + check_generated /etc/httpd/server-ecdsa.key
>> fi
>>
>> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
>> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
>> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
>> openssl req -new -key /etc/httpd/server-ecdsa.key \
>> -out /etc/httpd/server-ecdsa.csr &>/dev/null
>> + check_generated /etc/httpd/server-ecdsa.csr
>> fi
>>
>> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
>> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
>> boot_mesg "Signing ECDSA certificate..."
>> openssl x509 -req -days 999999 -sha256 \
>> -in /etc/httpd/server-ecdsa.csr \
>> -signkey /etc/httpd/server-ecdsa.key \
>> -out /etc/httpd/server-ecdsa.crt &>/dev/null
>> evaluate_retval
>> + check_generated /etc/httpd/server-ecdsa.crt
>> fi
>> }
>>
>> --
>> 2.34.1
>>
>>
>
>

Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Michael Tremer]

Hey Vincent,

It looks like the keys were generated correctly, but not flushed to the file system yet. When the power was reset the keys were lost, but empty files left behind. That should actually not happen with a modern, journaled file system. If it does, let’s revisit this and see what we can change.

-Michael

> On 27 Oct 2026, at 23:00, Vincent Li <vincent.mc.li@gmail.com> wrote:
> 
> 
> Hi Michael,
> 
> This has happened to me only once. It occurred after completing the network setup during an ISO installation: the machine started all services, but during this period it appeared to hang and stopped responding. I had to power-reset the machine. After it booted up again, all services started fine except Apache, which reported a cert/key error. When I logged in, I found that the cert/key/csr files existed but were empty.
> 
> I don't know the exact reason why the cert/key/csr ended up empty during the first boot — perhaps the hang interrupted OpenSSL while it was in the middle of generating the cert/key, or something similar.
> 
> On Tue, 27 Oct 2026, Michael Tremer wrote:
> 
>> Hello Vincent,
>> 
>> Thank you very much for your email.
>> 
>> I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem.
>> 
>> All the best,
>> -Michael
>> 
>>> On 27 Oct 2026, at 06:36, Vincent Li <vincent.mc.li@gmail.com> wrote:
>>> 
>>> After completing an ISO installation, Apache was observed once to fail
>>> to start, leaving the web UI inaccessible.  Although this is a rare
>>> occurrence, the cause was that generate_certificates() used "test -f",
>>> which only checks that the key/CSR/cert files exist, not that they are
>>> non-empty.  If openssl fails to write a file during first boot (e.g.
>>> low entropy) but leaves an empty file behind, later starts consider the
>>> certificate already generated and skip regeneration, leaving Apache
>>> with empty server-ecdsa.key/crt and a broken web UI.
>>> 
>>> Use "test -s" instead so empty files are regenerated, and log a boot
>>> message via boot_mesg ${FAILURE} if a file is still empty after
>>> openssl runs.
>>> 
>>> Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
>>> ---
>>> src/initscripts/system/apache | 16 +++++++++++++---
>>> 1 file changed, 13 insertions(+), 3 deletions(-)
>>> 
>>> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
>>> index ba7ede670..7eba99b53 100644
>>> --- a/src/initscripts/system/apache
>>> +++ b/src/initscripts/system/apache
>>> @@ -24,28 +24,38 @@
>>> 
>>> PIDFILE="/var/run/httpd.pid"
>>> 
>>> +# Verify a generated file exists and is non-empty; log a boot message if not.
>>> +check_generated() {
>>> + if [ ! -s "$1" ]; then
>>> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
>>> + fi
>>> +}
>>> +
>>> generate_certificates() {
>>> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
>>> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
>>> boot_mesg "Generating HTTPS ECDSA server key..."
>>> openssl ecparam -genkey -name secp384r1 -noout \
>>> -out /etc/httpd/server-ecdsa.key &>/dev/null
>>> chmod 600 /etc/httpd/server-ecdsa.key
>>> evaluate_retval
>>> + check_generated /etc/httpd/server-ecdsa.key
>>> fi
>>> 
>>> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
>>> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
>>> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
>>> openssl req -new -key /etc/httpd/server-ecdsa.key \
>>> -out /etc/httpd/server-ecdsa.csr &>/dev/null
>>> + check_generated /etc/httpd/server-ecdsa.csr
>>> fi
>>> 
>>> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
>>> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
>>> boot_mesg "Signing ECDSA certificate..."
>>> openssl x509 -req -days 999999 -sha256 \
>>> -in /etc/httpd/server-ecdsa.csr \
>>> -signkey /etc/httpd/server-ecdsa.key \
>>> -out /etc/httpd/server-ecdsa.crt &>/dev/null
>>> evaluate_retval
>>> + check_generated /etc/httpd/server-ecdsa.crt
>>> fi
>>> }
>>> 
>>> --
>>> 2.34.1
>>> 
>>> 
>> 

Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Vincent Li]

[-- Attachment #1: Type: text/plain, Size: 4283 bytes --]

Got it, no problem.

On Wed, 28 Oct 2026, Michael Tremer wrote:

> Hey Vincent,
>
> It looks like the keys were generated correctly, but not flushed to the file system yet. When the power was reset the keys were lost, but empty files left behind. That should actually not happen with a modern, journaled file system. If it does, let’s revisit this and see what we can change.
>
> -Michael
>
>> On 27 Oct 2026, at 23:00, Vincent Li <vincent.mc.li@gmail.com> wrote:
>>
>>
>> Hi Michael,
>>
>> This has happened to me only once. It occurred after completing the network setup during an ISO installation: the machine started all services, but during this period it appeared to hang and stopped responding. I had to power-reset the machine. After it booted up again, all services started fine except Apache, which reported a cert/key error. When I logged in, I found that the cert/key/csr files existed but were empty.
>>
>> I don't know the exact reason why the cert/key/csr ended up empty during the first boot — perhaps the hang interrupted OpenSSL while it was in the middle of generating the cert/key, or something similar.
>>
>> On Tue, 27 Oct 2026, Michael Tremer wrote:
>>
>>> Hello Vincent,
>>>
>>> Thank you very much for your email.
>>>
>>> I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem.
>>>
>>> All the best,
>>> -Michael
>>>
>>>> On 27 Oct 2026, at 06:36, Vincent Li <vincent.mc.li@gmail.com> wrote:
>>>>
>>>> After completing an ISO installation, Apache was observed once to fail
>>>> to start, leaving the web UI inaccessible.  Although this is a rare
>>>> occurrence, the cause was that generate_certificates() used "test -f",
>>>> which only checks that the key/CSR/cert files exist, not that they are
>>>> non-empty.  If openssl fails to write a file during first boot (e.g.
>>>> low entropy) but leaves an empty file behind, later starts consider the
>>>> certificate already generated and skip regeneration, leaving Apache
>>>> with empty server-ecdsa.key/crt and a broken web UI.
>>>>
>>>> Use "test -s" instead so empty files are regenerated, and log a boot
>>>> message via boot_mesg ${FAILURE} if a file is still empty after
>>>> openssl runs.
>>>>
>>>> Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
>>>> ---
>>>> src/initscripts/system/apache | 16 +++++++++++++---
>>>> 1 file changed, 13 insertions(+), 3 deletions(-)
>>>>
>>>> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
>>>> index ba7ede670..7eba99b53 100644
>>>> --- a/src/initscripts/system/apache
>>>> +++ b/src/initscripts/system/apache
>>>> @@ -24,28 +24,38 @@
>>>>
>>>> PIDFILE="/var/run/httpd.pid"
>>>>
>>>> +# Verify a generated file exists and is non-empty; log a boot message if not.
>>>> +check_generated() {
>>>> + if [ ! -s "$1" ]; then
>>>> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
>>>> + fi
>>>> +}
>>>> +
>>>> generate_certificates() {
>>>> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
>>>> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
>>>> boot_mesg "Generating HTTPS ECDSA server key..."
>>>> openssl ecparam -genkey -name secp384r1 -noout \
>>>> -out /etc/httpd/server-ecdsa.key &>/dev/null
>>>> chmod 600 /etc/httpd/server-ecdsa.key
>>>> evaluate_retval
>>>> + check_generated /etc/httpd/server-ecdsa.key
>>>> fi
>>>>
>>>> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
>>>> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
>>>> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
>>>> openssl req -new -key /etc/httpd/server-ecdsa.key \
>>>> -out /etc/httpd/server-ecdsa.csr &>/dev/null
>>>> + check_generated /etc/httpd/server-ecdsa.csr
>>>> fi
>>>>
>>>> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
>>>> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
>>>> boot_mesg "Signing ECDSA certificate..."
>>>> openssl x509 -req -days 999999 -sha256 \
>>>> -in /etc/httpd/server-ecdsa.csr \
>>>> -signkey /etc/httpd/server-ecdsa.key \
>>>> -out /etc/httpd/server-ecdsa.crt &>/dev/null
>>>> evaluate_retval
>>>> + check_generated /etc/httpd/server-ecdsa.crt
>>>> fi
>>>> }
>>>>
>>>> --
>>>> 2.34.1
>>>>
>>>>
>>>
>
>