diff mbox series

initscripts: apache: Regenerate empty ECDSA certificate files on start

Message ID 20261027063635.1775102-1-vincent.mc.li@gmail.com
State New
Headers
Series initscripts: apache: Regenerate empty ECDSA certificate files on start |

Commit Message

Vincent Li 27 Oct 2026, 6:36 a.m. UTC 
After completing an ISO installation, Apache was observed once to fail
to start, leaving the web UI inaccessible.  Although this is a rare
occurrence, the cause was that generate_certificates() used "test -f",
which only checks that the key/CSR/cert files exist, not that they are
non-empty.  If openssl fails to write a file during first boot (e.g.
low entropy) but leaves an empty file behind, later starts consider the
certificate already generated and skip regeneration, leaving Apache
with empty server-ecdsa.key/crt and a broken web UI.

Use "test -s" instead so empty files are regenerated, and log a boot
message via boot_mesg ${FAILURE} if a file is still empty after
openssl runs.

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
---
 src/initscripts/system/apache | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

Comments

Michael Tremer 27 Oct 2026, 10:01 a.m. UTC | #1 
Hello Vincent,

Thank you very much for your email.

I have a question regarding this change which is why it is required at all? There should never be an empty file and if there is one, I am not sure it is a good idea to quietly replace the certificate. So please let me know what caused this problem.

All the best,
-Michael

> On 27 Oct 2026, at 06:36, Vincent Li <vincent.mc.li@gmail.com> wrote:
> 
> After completing an ISO installation, Apache was observed once to fail
> to start, leaving the web UI inaccessible.  Although this is a rare
> occurrence, the cause was that generate_certificates() used "test -f",
> which only checks that the key/CSR/cert files exist, not that they are
> non-empty.  If openssl fails to write a file during first boot (e.g.
> low entropy) but leaves an empty file behind, later starts consider the
> certificate already generated and skip regeneration, leaving Apache
> with empty server-ecdsa.key/crt and a broken web UI.
> 
> Use "test -s" instead so empty files are regenerated, and log a boot
> message via boot_mesg ${FAILURE} if a file is still empty after
> openssl runs.
> 
> Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
> ---
> src/initscripts/system/apache | 16 +++++++++++++---
> 1 file changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
> index ba7ede670..7eba99b53 100644
> --- a/src/initscripts/system/apache
> +++ b/src/initscripts/system/apache
> @@ -24,28 +24,38 @@
> 
> PIDFILE="/var/run/httpd.pid"
> 
> +# Verify a generated file exists and is non-empty; log a boot message if not.
> +check_generated() {
> + if [ ! -s "$1" ]; then
> + boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
> + fi
> +}
> +
> generate_certificates() {
> - if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
> boot_mesg "Generating HTTPS ECDSA server key..."
> openssl ecparam -genkey -name secp384r1 -noout \
> -out /etc/httpd/server-ecdsa.key &>/dev/null
> chmod 600 /etc/httpd/server-ecdsa.key
> evaluate_retval
> + check_generated /etc/httpd/server-ecdsa.key
> fi
> 
> - if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
> sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
> openssl req -new -key /etc/httpd/server-ecdsa.key \
> -out /etc/httpd/server-ecdsa.csr &>/dev/null
> + check_generated /etc/httpd/server-ecdsa.csr
> fi
> 
> - if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
> + if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
> boot_mesg "Signing ECDSA certificate..."
> openssl x509 -req -days 999999 -sha256 \
> -in /etc/httpd/server-ecdsa.csr \
> -signkey /etc/httpd/server-ecdsa.key \
> -out /etc/httpd/server-ecdsa.crt &>/dev/null
> evaluate_retval
> + check_generated /etc/httpd/server-ecdsa.crt
> fi
> }
> 
> -- 
> 2.34.1
> 
>
diff mbox series

Patch

diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache
index ba7ede670..7eba99b53 100644
--- a/src/initscripts/system/apache
+++ b/src/initscripts/system/apache
@@ -24,28 +24,38 @@ 
 
 PIDFILE="/var/run/httpd.pid"
 
+# Verify a generated file exists and is non-empty; log a boot message if not.
+check_generated() {
+	if [ ! -s "$1" ]; then
+		boot_mesg "ERROR: $1 is missing or empty!" ${FAILURE}
+	fi
+}
+
 generate_certificates() {
-	if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.key" ]; then
 		boot_mesg "Generating HTTPS ECDSA server key..."
 		openssl ecparam -genkey -name secp384r1 -noout \
 			-out /etc/httpd/server-ecdsa.key &>/dev/null
 		chmod 600 /etc/httpd/server-ecdsa.key
 		evaluate_retval
+		check_generated /etc/httpd/server-ecdsa.key
 	fi
 
-	if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.csr" ]; then
 		sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
 			openssl req -new -key /etc/httpd/server-ecdsa.key \
 			-out /etc/httpd/server-ecdsa.csr &>/dev/null
+		check_generated /etc/httpd/server-ecdsa.csr
 	fi
 
-	if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then
+	if [ ! -s "/etc/httpd/server-ecdsa.crt" ]; then
 		boot_mesg "Signing ECDSA certificate..."
 		openssl x509 -req -days 999999 -sha256 \
 			-in /etc/httpd/server-ecdsa.csr \
 			-signkey /etc/httpd/server-ecdsa.key \
 			-out /etc/httpd/server-ecdsa.crt &>/dev/null
 		evaluate_retval
+		check_generated /etc/httpd/server-ecdsa.crt
 	fi
 }