From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jF4Bg15hrz30Ch for ; Wed, 28 Oct 2026 10:59:55 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jF4Bb3mwGz2xHd for ; Wed, 28 Oct 2026 10:59:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jF4BZ4gmZz5P; Wed, 28 Oct 2026 10:59:50 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793185190; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/VZbVriI3G3b/rIehi6OiDmSDxIbMzPy8Gm7zyt2s4U=; b=kakiS77QvCfss90u7SeyN3pkxi4fqhuhi32PlN2X9I1mKxYHGeh2MpSovtuxeSviZXZiqa nDTlUV1k2WKxTvBg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793185190; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/VZbVriI3G3b/rIehi6OiDmSDxIbMzPy8Gm7zyt2s4U=; b=j9MoFG5llFYU6UQGbgtzCVydMfOgdhA6u7RIH2e7E/XSmVEXvkiaHs3EYa9U10HXfIg4sJ LT9Kc/s2gNiatBdy3W7qwkBlF+fe4IKB256wMIa5GEugIaXFmXp5HH3iBoOKjgJqFVQxSM kJ7/qnrUF7/QelaM0gntySWXrv086BJdo78elMPH0hbqUfbHXl4bPucSUQv+FuKBBMa8sr mkPip1SQE5e7aa/YQvy8MDx9DGgmyk92oHWDZKXkxh8PrGVCzR4NiQdbGxhNp0hAH2VcWC KOAojo299QyMnnz6ap/vjFws4LcMM4k8lsrP3QsME1usH7MmyrS9yvGwUlHfSQ== Content-Type: text/plain; charset=utf-8 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start From: Michael Tremer In-Reply-To: Date: Wed, 28 Oct 2026 10:59:50 +0000 Cc: development@lists.ipfire.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20261027063635.1775102-1-vincent.mc.li@gmail.com> To: Vincent Li Hey Vincent, It looks like the keys were generated correctly, but not flushed to the = file system yet. When the power was reset the keys were lost, but empty = files left behind. That should actually not happen with a modern, = journaled file system. If it does, let=E2=80=99s revisit this and see = what we can change. -Michael > On 27 Oct 2026, at 23:00, Vincent Li wrote: >=20 >=20 > Hi Michael, >=20 > This has happened to me only once. It occurred after completing the = network setup during an ISO installation: the machine started all = services, but during this period it appeared to hang and stopped = responding. I had to power-reset the machine. After it booted up again, = all services started fine except Apache, which reported a cert/key = error. When I logged in, I found that the cert/key/csr files existed but = were empty. >=20 > I don't know the exact reason why the cert/key/csr ended up empty = during the first boot =E2=80=94 perhaps the hang interrupted OpenSSL = while it was in the middle of generating the cert/key, or something = similar. >=20 > On Tue, 27 Oct 2026, Michael Tremer wrote: >=20 >> Hello Vincent, >>=20 >> Thank you very much for your email. >>=20 >> I have a question regarding this change which is why it is required = at all? There should never be an empty file and if there is one, I am = not sure it is a good idea to quietly replace the certificate. So please = let me know what caused this problem. >>=20 >> All the best, >> -Michael >>=20 >>> On 27 Oct 2026, at 06:36, Vincent Li = wrote: >>>=20 >>> After completing an ISO installation, Apache was observed once to = fail >>> to start, leaving the web UI inaccessible. Although this is a rare >>> occurrence, the cause was that generate_certificates() used "test = -f", >>> which only checks that the key/CSR/cert files exist, not that they = are >>> non-empty. If openssl fails to write a file during first boot (e.g. >>> low entropy) but leaves an empty file behind, later starts consider = the >>> certificate already generated and skip regeneration, leaving Apache >>> with empty server-ecdsa.key/crt and a broken web UI. >>>=20 >>> Use "test -s" instead so empty files are regenerated, and log a boot >>> message via boot_mesg ${FAILURE} if a file is still empty after >>> openssl runs. >>>=20 >>> Signed-off-by: Vincent Li >>> --- >>> src/initscripts/system/apache | 16 +++++++++++++--- >>> 1 file changed, 13 insertions(+), 3 deletions(-) >>>=20 >>> diff --git a/src/initscripts/system/apache = b/src/initscripts/system/apache >>> index ba7ede670..7eba99b53 100644 >>> --- a/src/initscripts/system/apache >>> +++ b/src/initscripts/system/apache >>> @@ -24,28 +24,38 @@ >>>=20 >>> PIDFILE=3D"/var/run/httpd.pid" >>>=20 >>> +# Verify a generated file exists and is non-empty; log a boot = message if not. >>> +check_generated() { >>> + if [ ! -s "$1" ]; then >>> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE} >>> + fi >>> +} >>> + >>> generate_certificates() { >>> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then >>> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then >>> boot_mesg "Generating HTTPS ECDSA server key..." >>> openssl ecparam -genkey -name secp384r1 -noout \ >>> -out /etc/httpd/server-ecdsa.key &>/dev/null >>> chmod 600 /etc/httpd/server-ecdsa.key >>> evaluate_retval >>> + check_generated /etc/httpd/server-ecdsa.key >>> fi >>>=20 >>> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then >>> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then >>> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ >>> openssl req -new -key /etc/httpd/server-ecdsa.key \ >>> -out /etc/httpd/server-ecdsa.csr &>/dev/null >>> + check_generated /etc/httpd/server-ecdsa.csr >>> fi >>>=20 >>> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then >>> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then >>> boot_mesg "Signing ECDSA certificate..." >>> openssl x509 -req -days 999999 -sha256 \ >>> -in /etc/httpd/server-ecdsa.csr \ >>> -signkey /etc/httpd/server-ecdsa.key \ >>> -out /etc/httpd/server-ecdsa.crt &>/dev/null >>> evaluate_retval >>> + check_generated /etc/httpd/server-ecdsa.crt >>> fi >>> } >>>=20 >>> -- >>> 2.34.1 >>>=20 >>>=20 >>=20