From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jDmDp74DLz2xpj for ; Tue, 27 Oct 2026 23:00:42 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jDmDl3f09z2xLm for ; Tue, 27 Oct 2026 23:00:39 +0000 (UTC) Received: from mail-pf1-x42b.google.com (mail-pf1-x42b.google.com [IPv6:2607:f8b0:4864:20::42b]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jDmDk2CxkzyD for ; Tue, 27 Oct 2026 23:00:38 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=gmail.com header.s=20260707 header.b=NUlCgjgt; spf=pass (mail01.ipfire.org: domain of vincent.mc.li@gmail.com designates 2607:f8b0:4864:20::42b as permitted sender) smtp.mailfrom=vincent.mc.li@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; d=lists.ipfire.org; s=202003rsa; cv=none; t=1793142038; b=YHg4QNnpvzzKNJXRXjC1fFQVNiIVp4Rf68Fn9hOunMbhHUnyW7jgNdfKOTt8KA3D+3OZmi LCA15k43MDVXe7WcR358s9NXV5/YVzFaT4IQPf5r0k7qjGVhMFxNq2aycMawbuQg7UMglp 03OpOzZEAHsE0jaTuzghtW67GAYjqJbHl0fuqlYYqkFXOEy/j8GAQv+6576r6rIf9AKjyY K0iiJGmeTvp6LkpVwBf3T+7l/CTfaJv8W5dv6rZDcjEiX96z+Ud+HaNP+8PtZTWKMaycaJ QdALLR5S+yiN99voPSwS4WvKW7JISIa0txlJM7ujHyfPH6TKSmad7/31d6fGBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1793142038; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references:dkim-signature; bh=VWDohpBCTZ39Vn1WASTCzAa83Mt/9JhXcV/2uLaGsfQ=; b=lmA5Nz4ynzIjRAAtVxEC7n7EDs6mLflXJjkL5WIHmQDF5sb2VvmX6mrKOpUsxFgCBhAaPC ehvIK8+C19jR0jJ41kALQov87CXXtvVUd4VbwKv0dr7VXi8UDC8Ho2oLFGZ5jSk/Tw+24N 9vQ6AsxgNXHQ1EpfBPxpXaUn96HImk8/s9PUHkN7mjp4tCIsxMeHxRnqa3KyMeis6RVG6Y e7lGTCOPNN+I4CNWYLWouLbud+2VuVvLGuhhfNhproyeUfbRn3zTNlxQMdDkwkBVqeOsRO 1+RlpWCjRoYdX3MGfQwRw3s/erqvNRCN6TvlArtGsOvK4kVyK65hWJVXLw4A5w== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=gmail.com header.s=20260707 header.b=NUlCgjgt; spf=pass (mail01.ipfire.org: domain of vincent.mc.li@gmail.com designates 2607:f8b0:4864:20::42b as permitted sender) smtp.mailfrom=vincent.mc.li@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-pf1-x42b.google.com with SMTP id d2e1a72fcca58-8a05f2d5cd3so204754b3a.0 for ; Tue, 27 Oct 2026 16:00:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793142036; x=1793746836; darn=lists.ipfire.org; h=content-type:mime-version:references:message-id:in-reply-to:subject :cc:to:date:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=VWDohpBCTZ39Vn1WASTCzAa83Mt/9JhXcV/2uLaGsfQ=; b=NUlCgjgtPd9jq+Zv4jrieQaOFV/6drBzGhobfrbIFdb9c+7z+f/U27+05W7Ju47gPR ZXawJve3B0+JVi5FXMns2UH0jn05Py614uiGGMoV+hellNjKmw68dswsmfQx2lnLqLIZ JrEW7lFwnNhOHiFmJ5Uf3GQ8Dji78LSYSFpr9FruYqd2kBZ+Bpi2otZAtqJ0w4n08jhL U4mdytIV360fVUfxgbW21+p9B1DgxgPIgvYtJSHT2mLHhta8RSPSBSZ1fZX1ieU3hBE/ 74DVQtCKYVW5dItuVfGpo6X7Thb3giPafhz8bA3ffgC4iLHUwnTu7uzQTMDMxQZWDAhj nE3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793142036; x=1793746836; h=content-type:mime-version:references:message-id:in-reply-to:subject :cc:to:date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VWDohpBCTZ39Vn1WASTCzAa83Mt/9JhXcV/2uLaGsfQ=; b=wtH3uznc5x4799BHN/MwMe4rW22pzA1npGOwiDRyavUeMI6z2XnaijTuGb/7G8oi7T P8zMtokc9BCWAIbbRtdTnbDHXmLvr+BDFId3SaQPp2KbFcTEWAOiNl25JFVsPz+uCPD1 OeCCAyr737P+Xx8v1iXVJ05eDRTS0va8P0OPbfckt8IXY39v4Gp6WVjYq+2OwkqTHkGq fH4Anii/R/zlludx2jV8OIctsDOun9ip+hyi1T2gX9sMEG/4cgbr8M7qGD9AXHzmGE76 BOnCZ0ZX4cwUfPoq6IDLKkpWHrS5xYtA+l2jgtOHowux0Pr5Xkln7w8gePMq3u+CxNgw 43wQ== X-Forwarded-Encrypted: i=1; AKwUvBxWFIAWgfu/dkbQsrKmSxQAHqj/itSEjZjCS089djwe1Dk66c4S4nDQRPdk7UNBSoGwgOu7oASDbquOOg==@lists.ipfire.org X-Gm-Message-State: AFq9FYKYVK92pbrbm6BpJFiMJXoGaqXazc9qIM+Gz5/BQ7IkOQiyLILk ZcYLzSBPx7shGiSZbylGWdCbMOLO8fUQ5JpGOagE3NWEUAdGk1pYVHSz X-Gm-Gg: AYBFou0oJgRjhPEUQNAgHxNjQ/1flc+daPj2XI7wx9pEbt1qJvgiNnRSNfX7mdJqSII iJxfaSKguFoxxI3xAaB0inhuO4X3xopak0nLIL7WlBHVTiLMfZWEoYPO5CgoC7Mq6x7C/B80nFs ly0YLbV4PqSRz5RegXIMrdq8VVZXTB9z52PVFkZGgUccUCDVqJYN68HUVzfcry83CTXr2nLUU6L Vc8Hkyu/g+VWDQEOyFrfeN/4IeqnZvZVwz2LUkjMMnF27YpO2Z2Pt39aKfCv2UrbedTYK2Wiqdu ozF4Yrrp8NiduDnx7kT0DyS4LaK4AOw5pAPt68CY4u+f6lRedMe+j4sBW/mgngZfEVmVV+iIq5D gfFMBG2WILryXrB7GxOheLO5GdS30luFAd85sU5i6XYpIEVHzsA94kJloaMFM7DJX/NDeIOge1w mZ3VtPaY3tBOrFmjpb5pDBvzZg8zzXbPD9eCWdyMpqVhS4jyQUdfWWLej+S5Wr3tsRUhmwLhKuU K92Ni+hWGBC9hyjKEIt289rQTm8k/pnBNZyPRbcwCQK8RDiyEOvs00S+OUJTd4nbvEs9GmEC8te Pa1a3xtC/Fq1B5W6mG4QmLUnG7Y18g== X-Received: by 2002:a05:6a21:7d06:b0:3e2:313d:2dab with SMTP id adf61e73a8af0-3e902445034mr426028637.69.1793142035782; Tue, 27 Oct 2026 16:00:35 -0700 (PDT) Received: from wg-vpn-sf2 ([138.197.218.192]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8a6a73c165fsm515519b3a.54.2026.10.27.16.00.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Oct 2026 16:00:34 -0700 (PDT) From: Vincent Li X-Google-Original-From: Vincent Li Date: Tue, 27 Oct 2026 23:00:32 +0000 (UTC) To: Michael Tremer cc: Vincent Li , development@lists.ipfire.org Subject: Re: [PATCH] initscripts: apache: Regenerate empty ECDSA certificate files on start In-Reply-To: Message-ID: References: <20261027063635.1775102-1-vincent.mc.li@gmail.com> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="8323329-918468386-1793142034=:1802031" X-Rspamd-Action: no action X-Spamd-Result: default: False [-6.33 / 11.00]; BAYES_HAM(-3.00)[100.00%]; R_DKIM_ALLOW(-1.60)[gmail.com:s=20260707]; CTYPE_MIXED_BOGUS(1.00)[]; DKIM_REPUTATION(-0.97)[-0.96869970827625]; SPF_REPUTATION_HAM(-0.77)[-0.76932555899696]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4864::/56]; R_DKIM_ALIGNED(-0.10)[strict]; MX_GOOD(-0.10)[gmail-smtp-in.l.google.com]; MIME_GOOD(-0.10)[multipart/mixed,text/plain]; RCVD_TLS_LAST(0.00)[]; IP_REPUTATION_HAM(0.00)[asn: 15169(-0.30), country: US(-0.01), ip: 2607:f8b0:4864:20::(-0.80)]; MIME_TRACE(0.00)[0:+,1:+]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; ARC_NA(0.00)[]; FREEMAIL_ENVFROM(0.00)[gmail.com]; TO_DN_SOME(0.00)[]; FREEMAIL_FROM(0.00)[gmail.com]; FROM_HAS_DN(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::42b:from]; TO_MATCH_ENVRCPT_SOME(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[development@lists.ipfire.org]; RCVD_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; FREEMAIL_CC(0.00)[gmail.com,lists.ipfire.org]; ALIAS_RESOLVED(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; MID_RHS_MATCH_FROM(0.00)[]; MISSING_XM_UA(0.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1] X-Rspamd-Server: mail01.haj.ipfire.org X-Rspamd-Queue-Id: 4jDmDk2CxkzyD This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --8323329-918468386-1793142034=:1802031 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8BIT Hi Michael, This has happened to me only once. It occurred after completing the network setup during an ISO installation: the machine started all services, but during this period it appeared to hang and stopped responding. I had to power-reset the machine. After it booted up again, all services started fine except Apache, which reported a cert/key error. When I logged in, I found that the cert/key/csr files existed but were empty. I don't know the exact reason why the cert/key/csr ended up empty during the first boot — perhaps the hang interrupted OpenSSL while it was in the middle of generating the cert/key, or something similar. On Tue, 27 Oct 2026, Michael Tremer wrote: > Hello Vincent, > > Thank you very much for your email. > > I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem. > > All the best, > -Michael > >> On 27 Oct 2026, at 06:36, Vincent Li wrote: >> >> After completing an ISO installation, Apache was observed once to fail >> to start, leaving the web UI inaccessible. Although this is a rare >> occurrence, the cause was that generate_certificates() used "test -f", >> which only checks that the key/CSR/cert files exist, not that they are >> non-empty. If openssl fails to write a file during first boot (e.g. >> low entropy) but leaves an empty file behind, later starts consider the >> certificate already generated and skip regeneration, leaving Apache >> with empty server-ecdsa.key/crt and a broken web UI. >> >> Use "test -s" instead so empty files are regenerated, and log a boot >> message via boot_mesg ${FAILURE} if a file is still empty after >> openssl runs. >> >> Signed-off-by: Vincent Li >> --- >> src/initscripts/system/apache | 16 +++++++++++++--- >> 1 file changed, 13 insertions(+), 3 deletions(-) >> >> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache >> index ba7ede670..7eba99b53 100644 >> --- a/src/initscripts/system/apache >> +++ b/src/initscripts/system/apache >> @@ -24,28 +24,38 @@ >> >> PIDFILE="/var/run/httpd.pid" >> >> +# Verify a generated file exists and is non-empty; log a boot message if not. >> +check_generated() { >> + if [ ! -s "$1" ]; then >> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE} >> + fi >> +} >> + >> generate_certificates() { >> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then >> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then >> boot_mesg "Generating HTTPS ECDSA server key..." >> openssl ecparam -genkey -name secp384r1 -noout \ >> -out /etc/httpd/server-ecdsa.key &>/dev/null >> chmod 600 /etc/httpd/server-ecdsa.key >> evaluate_retval >> + check_generated /etc/httpd/server-ecdsa.key >> fi >> >> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then >> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then >> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ >> openssl req -new -key /etc/httpd/server-ecdsa.key \ >> -out /etc/httpd/server-ecdsa.csr &>/dev/null >> + check_generated /etc/httpd/server-ecdsa.csr >> fi >> >> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then >> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then >> boot_mesg "Signing ECDSA certificate..." >> openssl x509 -req -days 999999 -sha256 \ >> -in /etc/httpd/server-ecdsa.csr \ >> -signkey /etc/httpd/server-ecdsa.key \ >> -out /etc/httpd/server-ecdsa.crt &>/dev/null >> evaluate_retval >> + check_generated /etc/httpd/server-ecdsa.crt >> fi >> } >> >> -- >> 2.34.1 >> >> > > --8323329-918468386-1793142034=:1802031--