Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Vincent Li <vincent.mc.li@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 4283 bytes --]

Got it, no problem.

On Wed, 28 Oct 2026, Michael Tremer wrote:

> Hey Vincent,
>
> It looks like the keys were generated correctly, but not flushed to the file system yet. When the power was reset the keys were lost, but empty files left behind. That should actually not happen with a modern, journaled file system. If it does, let’s revisit this and see what we can change.
>
> -Michael
>
>> On 27 Oct 2026, at 23:00, Vincent Li <vincent.mc.li@gmail.com> wrote:
>>
>>
>> Hi Michael,
>>
>> This has happened to me only once. It occurred after completing the network setup during an ISO installation: the machine started all services, but during this period it appeared to hang and stopped responding. I had to power-reset the machine. After it booted up again, all services started fine except Apache, which reported a cert/key error. When I logged in, I found that the cert/key/csr files existed but were empty.
>>
>> I don't know the exact reason why the cert/key/csr ended up empty during the first boot — perhaps the hang interrupted OpenSSL while it was in the middle of generating the cert/key, or something similar.
>>
>> On Tue, 27 Oct 2026, Michael Tremer wrote:
>>
>>> Hello Vincent,
>>>
>>> Thank you very much for your email.
>>>
>>> I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem.
>>>
>>> All the best,
>>> -Michael
>>>
>>>> On 27 Oct 2026, at 06:36, Vincent Li <vincent.mc.li@gmail.com> wrote:
>>>>
>>>> After completing an ISO installation, Apache was observed once to fail
>>>> to start, leaving the web UI inaccessible.  Although this is a rare
>>>> occurrence, the cause was that generate_certificates() used "test -f",
>>>> which only checks that the key/CSR/cert files exist, not that they are
>>>> non-empty.  If openssl fails to write a file during first boot (e.g.
>>>> low entropy) but leaves an empty file behind, later starts consider the
>>>> certificate already generated and skip regeneration, leaving Apache
>>>> with empty server-ecdsa.key/crt and a broken web UI.
>>>>
>>>> Use "test -s" instead so empty files are regenerated, and log a boot
>>>> message via boot_mesg ${FAILURE} if a file is still empty after
>>>> openssl runs.
>>>>
>>>> Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
>>>> ---
>>>> src/initscripts/system/apache | 16 +++++++++++++---
>>>> 1 file changed, 13 insertions(+), 3 deletions(-)
>>>>
>>>> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
>>>> index ba7ede670..7eba99b53 100644
>>>> --- a/src/initscripts/system/apache
>>>> +++ b/src/initscripts/system/apache
>>>> @@ -24,28 +24,38 @@
>>>>
>>>> PIDFILE="/var/run/httpd.pid"
>>>>
>>>> +# Verify a generated file exists and is non-empty; log a boot message if not.
>>>> +check_generated() {
>>>> + if [ ! -s "$1" ]; then
>>>> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
>>>> + fi
>>>> +}
>>>> +
>>>> generate_certificates() {
>>>> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
>>>> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
>>>> boot_mesg "Generating HTTPS ECDSA server key..."
>>>> openssl ecparam -genkey -name secp384r1 -noout \
>>>> -out /etc/httpd/server-ecdsa.key &>/dev/null
>>>> chmod 600 /etc/httpd/server-ecdsa.key
>>>> evaluate_retval
>>>> + check_generated /etc/httpd/server-ecdsa.key
>>>> fi
>>>>
>>>> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
>>>> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
>>>> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
>>>> openssl req -new -key /etc/httpd/server-ecdsa.key \
>>>> -out /etc/httpd/server-ecdsa.csr &>/dev/null
>>>> + check_generated /etc/httpd/server-ecdsa.csr
>>>> fi
>>>>
>>>> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
>>>> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
>>>> boot_mesg "Signing ECDSA certificate..."
>>>> openssl x509 -req -days 999999 -sha256 \
>>>> -in /etc/httpd/server-ecdsa.csr \
>>>> -signkey /etc/httpd/server-ecdsa.key \
>>>> -out /etc/httpd/server-ecdsa.crt &>/dev/null
>>>> evaluate_retval
>>>> + check_generated /etc/httpd/server-ecdsa.crt
>>>> fi
>>>> }
>>>>
>>>> --
>>>> 2.34.1
>>>>
>>>>
>>>
>
>