From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jFPMs642wz30S3 for ; Wed, 28 Oct 2026 23:54:01 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jFPMp2zYyz2xKC for ; Wed, 28 Oct 2026 23:53:58 +0000 (UTC) Received: from mail-dy1-x1333.google.com (mail-dy1-x1333.google.com [IPv6:2607:f8b0:4864:20::1333]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jFPMm0tcLz1rv for ; Wed, 28 Oct 2026 23:53:56 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=gmail.com header.s=20260707 header.b="jOp5bj8/"; spf=pass (mail01.ipfire.org: domain of vincent.mc.li@gmail.com designates 2607:f8b0:4864:20::1333 as permitted sender) smtp.mailfrom=vincent.mc.li@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; d=lists.ipfire.org; s=202003rsa; cv=none; t=1793231636; b=RM+JpYmCwa0qJnJCSawI6gIqA15Nii0zeWqCYVPtsNYqAjZJ7dbzctKOkXUztypgcQ8WTv obUUlvxIaJkB/ShwjBJV9UMkImEDjLDkU43lIEOLV9qv5pzmD1+yyUp9DtJ1ubAduMsPkN CFExH0ovbljaElkh21RAeGzT//WloHIXvBMns7vCsSnTLwsAKAleyRc1NejUH7dG9KnotB +F702ExtzapU8s/ollWi198Vfk5WgRGphwGxl7ywdZsu2/3/Mh5qRQpyQ+2iiBc27gcpjU ox+kc+xgU6oVJxDtZGKVgUZQr2mlNqzFl6A7jFGy+mSpx5vEsV45PrQ6ExV40Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1793231636; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ENG4XLILlZS4rTcidS1WtdvH1fJFEryI8svfsd7/Kc0=; b=fWdVoSXg9u85mVWNz/0nsxd/BftFlSXxqnMdkaoM5fnzxtPgUJoY85HRQJxhSyNO6EX+Ox 98c6kHsFmZboVgtThKH+S4dCKO/NfLTzMXQvP+VH5M6v0cOQAyXHzUDNlhp3Ok/jz4pd4J MrplQkuiTfToRCQ3Hvzo7/66IppUv/Udw0DpPl79lJ9aExBNOEnMZsVlGe0eJhlo3PUVnT +XIhlI0ooGiMYjI3HXT/ZA9wwRZ3VipRAluqhoHYkveTnByUuyoL4PPacvJ1z/5YvrSH1D 4kEW00ztPohtW9FGNxqFLGw0rledfDTHf1bR3uU4btm3K0tIAnyrMWczL9Avfw== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=gmail.com header.s=20260707 header.b="jOp5bj8/"; spf=pass (mail01.ipfire.org: domain of vincent.mc.li@gmail.com designates 2607:f8b0:4864:20::1333 as permitted sender) smtp.mailfrom=vincent.mc.li@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-dy1-x1333.google.com with SMTP id 5a478bee46e88-3282db206d3so6795eec.0 for ; Wed, 28 Oct 2026 16:53:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793231634; x=1793836434; darn=lists.ipfire.org; h=content-type:mime-version:references:message-id:in-reply-to:subject :cc:to:date:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ENG4XLILlZS4rTcidS1WtdvH1fJFEryI8svfsd7/Kc0=; b=jOp5bj8/+AFV/PS3VoCqlMLNvMznO/Ytw4UVt9MtuvbKqqR+UJkIs6N8ua8asXr9jk SouHjBpp3bW/MJuNlPuvndqtRELBLCatylugsYxLXIq2yt07LdzwGEhDWls5MdwO56i4 0Puz4/DZmTu4f9wibcVqMIgWlpSKKtjUEQgdabVBgp92O0hN4719NgLPhJ88hPJ03Wui ZTVkN0nWEvbKzGCuPNNZX/onDKTcIg/NfHKns3xifu5i2pyHDdWDDK3ZIVJp8Y8QJ9VN rFlCUwPmdAscckBCRDvnsuYFy50AaVLNlZTCEl+OeDkvEheXSK/JS/PxzkTewpuH8Hz0 5o4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793231634; x=1793836434; h=content-type:mime-version:references:message-id:in-reply-to:subject :cc:to:date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ENG4XLILlZS4rTcidS1WtdvH1fJFEryI8svfsd7/Kc0=; b=nmqaHqbbChoE5MOP52n5SjSQjYKjxuFiOcGVLf1wgP5atUnm83O7xPBRDnMkojVRsl 4YZ9fjvpCJpfLQx9Qj3EWQj5HDsjrmMN4sDdxMFh1Vpzonp923Y5AsVrtezHleessUA4 iN+iTE0wKXSsrFvWJM0KZNCtQNGkOot5nP/3SMiVzhLXI2ehVJgcVOEB6KM8RkU/4f/2 0ASdllSETmRU8NkxqDe0Y24U+Bz69//hDpZQX2jc6DdqeYDbakAr1KyR2GP+4bJmtolS zYCqvhitPEt+mZ55FT22vPNKIhj2MbXfqCwYspkcyIas24bWEvvZ3kQrNS3t1vz7XaYU cUQg== X-Forwarded-Encrypted: i=1; AKwUvBwSM7ycrjnX1NqW7mrzILJAbuds6xYeQjtJeOwfc3ex6xSFcFDQmY2eYhzKwbHYZdTmSBtYwL5RzpO5lg==@lists.ipfire.org X-Gm-Message-State: AFq9FYLlyDwIDflX9EV4YRXhXBXwiP6ttahLqhxsxObC5BoFM0WCzBka wpKEcIDQrElQhOSiysEKFhaSxN3mU8vrOaU/D5GdOGMM4Ac5zf8lBISj1VGl8A== X-Gm-Gg: AYBFou2nGHvA3dkeG4yJ0j0/VFKdqeBwsB1zefp5sfxML1fI2Gee+5OyBTtFxaB/Tyi mYzgrWd7s2xWsS+QO2KUO41kwML7VOyKIMBhWpx4yGQFFBrq/gcAfYq9AfTL3ES7ncHoF11c6Be ziL03waBsSYxncZ49I2UjD3zVGB08I/vlRhtK3ZQysQkXhCzP/dsykcve7H3URyoB6wNjqkQoRK FDn++P/GAc4pu7u5l1KqomL/b7Ku38IhC7s8F1+OMQFkhF/509T+UtbZu51Wq176TS5sqxwQ68I MfRFecvGVrAy0ou9/TdPFoOcJhns6I+/T0NYVuourWmadjro9YHDmvyAyNtSnJiqoLQ1wxEOk35 bwekjixIjkh8X8wXI0Gro7TDx14gxjEL95n7dzt9cXcUwGa6gV4ZLdhUzmBAcGmMYxcJfSKoQAk T5FnCGlrWpjCXVNaXUPVj5DBqkqL+f6C38E1wTusDPP1SRQZ+5w7iquaF7S5aMoZg5bAHxHEOgy 4i6TjThrsiBl8uOsAc865g2usmC5oWDg6nKtmEersH4yHLEedUYgHyoKKOgC84g0F9qvFI7k0jg UITQjlftW8yAEKT7/cHpRefLI71qCcg= X-Received: by 2002:a05:693c:8946:10b0:369:f7d2:d7a0 with SMTP id 5a478bee46e88-36a20407ad2mr5971853eec.25.1793231633494; Wed, 28 Oct 2026 16:53:53 -0700 (PDT) Received: from wg-vpn-sf2 ([138.197.218.192]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36a23908542sm11207822eec.10.2026.10.28.16.53.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 16:53:52 -0700 (PDT) From: Vincent Li X-Google-Original-From: Vincent Li Date: Wed, 28 Oct 2026 23:53:51 +0000 (UTC) To: Michael Tremer cc: Vincent Li , development@lists.ipfire.org Subject: Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start In-Reply-To: Message-ID: <9423cda3-9f54-48a2-8ac5-5b88c6ca7d7@gmail.com> References: <20261027063635.1775102-1-vincent.mc.li@gmail.com> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="8323329-1934970408-1793231632=:1822708" X-Rspamd-Action: no action X-Spamd-Result: default: False [-6.34 / 11.00]; BAYES_HAM(-3.00)[100.00%]; R_DKIM_ALLOW(-1.60)[gmail.com:s=20260707]; CTYPE_MIXED_BOGUS(1.00)[]; DKIM_REPUTATION(-0.97)[-0.9684037687479]; SPF_REPUTATION_HAM(-0.78)[-0.7753450801703]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4864::/56]; R_DKIM_ALIGNED(-0.10)[strict]; MX_GOOD(-0.10)[gmail-smtp-in.l.google.com]; MIME_GOOD(-0.10)[multipart/mixed,text/plain]; RCVD_TLS_LAST(0.00)[]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; FREEMAIL_ENVFROM(0.00)[gmail.com]; IP_REPUTATION_HAM(0.00)[asn: 15169(-0.30), country: US(-0.01), ip: 2607:f8b0:4864:20::(-0.80)]; FREEMAIL_FROM(0.00)[gmail.com]; MIME_TRACE(0.00)[0:+,1:+]; TO_DN_SOME(0.00)[]; FREEMAIL_CC(0.00)[gmail.com,lists.ipfire.org]; RCPT_COUNT_THREE(0.00)[3]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::1333:from]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; RCVD_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; PREVIOUSLY_DELIVERED(0.00)[development@lists.ipfire.org]; MID_RHS_MATCH_FROM(0.00)[]; MISSING_XM_UA(0.00)[]; ALIAS_RESOLVED(0.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1] X-Rspamd-Server: mail01.haj.ipfire.org X-Rspamd-Queue-Id: 4jFPMm0tcLz1rv This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --8323329-1934970408-1793231632=:1822708 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT Got it, no problem. On Wed, 28 Oct 2026, Michael Tremer wrote: > Hey Vincent, > > It looks like the keys were generated correctly, but not flushed to the file system yet. When the power was reset the keys were lost, but empty files left behind. That should actually not happen with a modern, journaled file system. If it does, let’s revisit this and see what we can change. > > -Michael > >> On 27 Oct 2026, at 23:00, Vincent Li wrote: >> >> >> Hi Michael, >> >> This has happened to me only once. It occurred after completing the network setup during an ISO installation: the machine started all services, but during this period it appeared to hang and stopped responding. I had to power-reset the machine. After it booted up again, all services started fine except Apache, which reported a cert/key error. When I logged in, I found that the cert/key/csr files existed but were empty. >> >> I don't know the exact reason why the cert/key/csr ended up empty during the first boot — perhaps the hang interrupted OpenSSL while it was in the middle of generating the cert/key, or something similar. >> >> On Tue, 27 Oct 2026, Michael Tremer wrote: >> >>> Hello Vincent, >>> >>> Thank you very much for your email. >>> >>> I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem. >>> >>> All the best, >>> -Michael >>> >>>> On 27 Oct 2026, at 06:36, Vincent Li wrote: >>>> >>>> After completing an ISO installation, Apache was observed once to fail >>>> to start, leaving the web UI inaccessible. Although this is a rare >>>> occurrence, the cause was that generate_certificates() used "test -f", >>>> which only checks that the key/CSR/cert files exist, not that they are >>>> non-empty. If openssl fails to write a file during first boot (e.g. >>>> low entropy) but leaves an empty file behind, later starts consider the >>>> certificate already generated and skip regeneration, leaving Apache >>>> with empty server-ecdsa.key/crt and a broken web UI. >>>> >>>> Use "test -s" instead so empty files are regenerated, and log a boot >>>> message via boot_mesg ${FAILURE} if a file is still empty after >>>> openssl runs. >>>> >>>> Signed-off-by: Vincent Li >>>> --- >>>> src/initscripts/system/apache | 16 +++++++++++++--- >>>> 1 file changed, 13 insertions(+), 3 deletions(-) >>>> >>>> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache >>>> index ba7ede670..7eba99b53 100644 >>>> --- a/src/initscripts/system/apache >>>> +++ b/src/initscripts/system/apache >>>> @@ -24,28 +24,38 @@ >>>> >>>> PIDFILE="/var/run/httpd.pid" >>>> >>>> +# Verify a generated file exists and is non-empty; log a boot message if not. >>>> +check_generated() { >>>> + if [ ! -s "$1" ]; then >>>> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE} >>>> + fi >>>> +} >>>> + >>>> generate_certificates() { >>>> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then >>>> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then >>>> boot_mesg "Generating HTTPS ECDSA server key..." >>>> openssl ecparam -genkey -name secp384r1 -noout \ >>>> -out /etc/httpd/server-ecdsa.key &>/dev/null >>>> chmod 600 /etc/httpd/server-ecdsa.key >>>> evaluate_retval >>>> + check_generated /etc/httpd/server-ecdsa.key >>>> fi >>>> >>>> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then >>>> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then >>>> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ >>>> openssl req -new -key /etc/httpd/server-ecdsa.key \ >>>> -out /etc/httpd/server-ecdsa.csr &>/dev/null >>>> + check_generated /etc/httpd/server-ecdsa.csr >>>> fi >>>> >>>> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then >>>> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then >>>> boot_mesg "Signing ECDSA certificate..." >>>> openssl x509 -req -days 999999 -sha256 \ >>>> -in /etc/httpd/server-ecdsa.csr \ >>>> -signkey /etc/httpd/server-ecdsa.key \ >>>> -out /etc/httpd/server-ecdsa.crt &>/dev/null >>>> evaluate_retval >>>> + check_generated /etc/httpd/server-ecdsa.crt >>>> fi >>>> } >>>> >>>> -- >>>> 2.34.1 >>>> >>>> >>> > > --8323329-1934970408-1793231632=:1822708--