Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Michael Tremer <michael.tremer@ipfire.org>]

Hello Vincent,

Thank you very much for your email.

I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem.

All the best,
-Michael

> On 27 Oct 2026, at 06:36, Vincent Li <vincent.mc.li@gmail.com> wrote:
> 
> After completing an ISO installation, Apache was observed once to fail
> to start, leaving the web UI inaccessible.  Although this is a rare
> occurrence, the cause was that generate_certificates() used "test -f",
> which only checks that the key/CSR/cert files exist, not that they are
> non-empty.  If openssl fails to write a file during first boot (e.g.
> low entropy) but leaves an empty file behind, later starts consider the
> certificate already generated and skip regeneration, leaving Apache
> with empty server-ecdsa.key/crt and a broken web UI.
> 
> Use "test -s" instead so empty files are regenerated, and log a boot
> message via boot_mesg ${FAILURE} if a file is still empty after
> openssl runs.
> 
> Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
> ---
> src/initscripts/system/apache | 16 +++++++++++++---
> 1 file changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
> index ba7ede670..7eba99b53 100644
> --- a/src/initscripts/system/apache
> +++ b/src/initscripts/system/apache
> @@ -24,28 +24,38 @@
> 
> PIDFILE="/var/run/httpd.pid"
> 
> +# Verify a generated file exists and is non-empty; log a boot message if not.
> +check_generated() {
> + if [ ! -s "$1" ]; then
> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
> + fi
> +}
> +
> generate_certificates() {
> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
> boot_mesg "Generating HTTPS ECDSA server key..."
> openssl ecparam -genkey -name secp384r1 -noout \
> -out /etc/httpd/server-ecdsa.key &>/dev/null
> chmod 600 /etc/httpd/server-ecdsa.key
> evaluate_retval
> + check_generated /etc/httpd/server-ecdsa.key
> fi
> 
> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
> openssl req -new -key /etc/httpd/server-ecdsa.key \
> -out /etc/httpd/server-ecdsa.csr &>/dev/null
> + check_generated /etc/httpd/server-ecdsa.csr
> fi
> 
> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
> boot_mesg "Signing ECDSA certificate..."
> openssl x509 -req -days 999999 -sha256 \
> -in /etc/httpd/server-ecdsa.csr \
> -signkey /etc/httpd/server-ecdsa.key \
> -out /etc/httpd/server-ecdsa.crt &>/dev/null
> evaluate_retval
> + check_generated /etc/httpd/server-ecdsa.crt
> fi
> }
> 
> -- 
> 2.34.1
> 
>