From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jDQxY4Nptz2xXH for ; Tue, 27 Oct 2026 10:01:21 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jDQxV0djrz2xWP for ; Tue, 27 Oct 2026 10:01:18 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jDQxT0K9xz1Pw; Tue, 27 Oct 2026 10:01:16 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793095277; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6xNXU4TT8k1sTEEw3oPjnMfM+HhvkSoNJ0p0fGA25yU=; b=yS25fBS8accy42dD4za9jiY9RNvEjTM1/YCqbyLymfy2nZhjlvob4jrQ2f7Dvu+506x7Ca 1gFcUyWGRx2fycCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793095277; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6xNXU4TT8k1sTEEw3oPjnMfM+HhvkSoNJ0p0fGA25yU=; b=Y8LHEupOr7J+NfGr9Ztw4w5MLzavPAgh1rtrSNQg/Wt86ZgS+R+yDQu36hxMxVe/HFwl9j udPuI1ZNrBppHaZ7gPhhQi33Hh/xedPa8xEagJlvdCLhz9He/cf3nEX1r1wOaOKc5zgvM0 u1zXLl/QNx7zBnaQnqEYAwJnDtBjVGA+RDPHE7cdGPkQ98S8wHB4kYwZ2R75s+x68BAmXP dL1KMwtfYxGedZX4y10eEDsSb3OYko7vRsTKpEBKN+pv+Z05necn4cBlc8+WQKU01BkE/D jcRRR/AxzE40MwLLa6sd9zSGHNltOt1Gb4lSwY/oecuxPlTaOrCcd1YSNfjsHA== Content-Type: text/plain; charset=us-ascii Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start From: Michael Tremer In-Reply-To: <20261027063635.1775102-1-vincent.mc.li@gmail.com> Date: Tue, 27 Oct 2026 10:01:16 +0000 Cc: development@lists.ipfire.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20261027063635.1775102-1-vincent.mc.li@gmail.com> To: Vincent Li Hello Vincent, Thank you very much for your email. I have a question regarding this change which is why it is required at = all? There should never be an empty file and if there is one, I am not = sure it is a good idea to quietly replace the certificate. So please let = me know what caused this problem. All the best, -Michael > On 27 Oct 2026, at 06:36, Vincent Li wrote: >=20 > After completing an ISO installation, Apache was observed once to fail > to start, leaving the web UI inaccessible. Although this is a rare > occurrence, the cause was that generate_certificates() used "test -f", > which only checks that the key/CSR/cert files exist, not that they are > non-empty. If openssl fails to write a file during first boot (e.g. > low entropy) but leaves an empty file behind, later starts consider = the > certificate already generated and skip regeneration, leaving Apache > with empty server-ecdsa.key/crt and a broken web UI. >=20 > Use "test -s" instead so empty files are regenerated, and log a boot > message via boot_mesg ${FAILURE} if a file is still empty after > openssl runs. >=20 > Signed-off-by: Vincent Li > --- > src/initscripts/system/apache | 16 +++++++++++++--- > 1 file changed, 13 insertions(+), 3 deletions(-) >=20 > diff --git a/src/initscripts/system/apache = b/src/initscripts/system/apache > index ba7ede670..7eba99b53 100644 > --- a/src/initscripts/system/apache > +++ b/src/initscripts/system/apache > @@ -24,28 +24,38 @@ >=20 > PIDFILE=3D"/var/run/httpd.pid" >=20 > +# Verify a generated file exists and is non-empty; log a boot message = if not. > +check_generated() { > + if [ ! -s "$1" ]; then > + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE} > + fi > +} > + > generate_certificates() { > - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then > + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then > boot_mesg "Generating HTTPS ECDSA server key..." > openssl ecparam -genkey -name secp384r1 -noout \ > -out /etc/httpd/server-ecdsa.key &>/dev/null > chmod 600 /etc/httpd/server-ecdsa.key > evaluate_retval > + check_generated /etc/httpd/server-ecdsa.key > fi >=20 > - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then > + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then > sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ > openssl req -new -key /etc/httpd/server-ecdsa.key \ > -out /etc/httpd/server-ecdsa.csr &>/dev/null > + check_generated /etc/httpd/server-ecdsa.csr > fi >=20 > - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then > + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then > boot_mesg "Signing ECDSA certificate..." > openssl x509 -req -days 999999 -sha256 \ > -in /etc/httpd/server-ecdsa.csr \ > -signkey /etc/httpd/server-ecdsa.key \ > -out /etc/httpd/server-ecdsa.crt &>/dev/null > evaluate_retval > + check_generated /etc/httpd/server-ecdsa.crt > fi > } >=20 > --=20 > 2.34.1 >=20 >=20