Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start

[Vincent Li <vincent.mc.li@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 3638 bytes --]


Hi Michael,

This has happened to me only once. It occurred after completing the 
network setup during an ISO installation: the machine started all 
services, but during this period it appeared to hang and stopped 
responding. I had to power-reset the machine. After it booted up again, 
all services started fine except Apache, which reported a cert/key error. 
When I logged in, I found that the cert/key/csr files existed but were 
empty.

I don't know the exact reason why the cert/key/csr ended up empty during 
the first boot — perhaps the hang interrupted OpenSSL while it was in the 
middle of generating the cert/key, or something similar.

On Tue, 27 Oct 2026, Michael Tremer wrote:

> Hello Vincent,
>
> Thank you very much for your email.
>
> I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem.
>
> All the best,
> -Michael
>
>> On 27 Oct 2026, at 06:36, Vincent Li <vincent.mc.li@gmail.com> wrote:
>>
>> After completing an ISO installation, Apache was observed once to fail
>> to start, leaving the web UI inaccessible.  Although this is a rare
>> occurrence, the cause was that generate_certificates() used "test -f",
>> which only checks that the key/CSR/cert files exist, not that they are
>> non-empty.  If openssl fails to write a file during first boot (e.g.
>> low entropy) but leaves an empty file behind, later starts consider the
>> certificate already generated and skip regeneration, leaving Apache
>> with empty server-ecdsa.key/crt and a broken web UI.
>>
>> Use "test -s" instead so empty files are regenerated, and log a boot
>> message via boot_mesg ${FAILURE} if a file is still empty after
>> openssl runs.
>>
>> Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
>> ---
>> src/initscripts/system/apache | 16 +++++++++++++---
>> 1 file changed, 13 insertions(+), 3 deletions(-)
>>
>> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
>> index ba7ede670..7eba99b53 100644
>> --- a/src/initscripts/system/apache
>> +++ b/src/initscripts/system/apache
>> @@ -24,28 +24,38 @@
>>
>> PIDFILE="/var/run/httpd.pid"
>>
>> +# Verify a generated file exists and is non-empty; log a boot message if not.
>> +check_generated() {
>> + if [ ! -s "$1" ]; then
>> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
>> + fi
>> +}
>> +
>> generate_certificates() {
>> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
>> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
>> boot_mesg "Generating HTTPS ECDSA server key..."
>> openssl ecparam -genkey -name secp384r1 -noout \
>> -out /etc/httpd/server-ecdsa.key &>/dev/null
>> chmod 600 /etc/httpd/server-ecdsa.key
>> evaluate_retval
>> + check_generated /etc/httpd/server-ecdsa.key
>> fi
>>
>> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
>> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
>> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
>> openssl req -new -key /etc/httpd/server-ecdsa.key \
>> -out /etc/httpd/server-ecdsa.csr &>/dev/null
>> + check_generated /etc/httpd/server-ecdsa.csr
>> fi
>>
>> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
>> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
>> boot_mesg "Signing ECDSA certificate..."
>> openssl x509 -req -days 999999 -sha256 \
>> -in /etc/httpd/server-ecdsa.csr \
>> -signkey /etc/httpd/server-ecdsa.key \
>> -out /etc/httpd/server-ecdsa.crt &>/dev/null
>> evaluate_retval
>> + check_generated /etc/httpd/server-ecdsa.crt
>> fi
>> }
>>
>> --
>> 2.34.1
>>
>>
>
>