X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=plc.d%2Fssl;h=ddbfe8166640263ed201115ed3e1f1aa6673745a;hb=2ae81168869377bdc861adb055206f41dd4c1ce4;hp=d483d4d374a351b66694047b01966515297ff4f1;hpb=536a6afdb908a510bf8cdbbe355a169445ec6548;p=myplc.git

diff --git a/plc.d/ssl b/plc.d/ssl
index d483d4d..ddbfe81 100755
--- a/plc.d/ssl
+++ b/plc.d/ssl
@@ -1,14 +1,12 @@
 #!/bin/bash
 #
-# priority: 400
+# priority: 300
 #
 # Generate SSL certificates
 #
 # Mark Huang <mlhuang@cs.princeton.edu>
 # Copyright (C) 2006 The Trustees of Princeton University
 #
-# $Id$
-#
 
 # Source function library and configuration
 . /etc/plc.d/functions
@@ -25,6 +23,14 @@ ssl_cname ()
 	lower
 }
 
+backup_file ()
+{
+    filepath=$1
+    filename=$(basename ${filepath})
+    dir=$(dirname ${filepath})
+    mv -f ${filepath} ${dir}/${filename}-`date +%Y-%m-%d-%H-%M-%S`.bak
+}
+
 # Verify a certificate. If invalid, generate a new self-signed
 # certificate.
 verify_or_generate_certificate() {
@@ -41,11 +47,12 @@ verify_or_generate_certificate() {
 
     if [ -f $crt ] ; then
 	# Check if certificate is valid
-	verify=$(openssl verify -CAfile $ca $crt)
-	# Delete if invalid or if the subject has changed
-	if grep -q "error" <<<$verify || \
+	# Backup if invalid or if the subject has changed
+	if openssl verify -CAfile $ca $crt | grep -q "error" || \
 	    [ "$(ssl_cname $crt)" != "$cname" ] ; then
-	    rm -f $crt $ca
+            backup_file $crt
+            backup_file $ca
+            backup_file $key
 	fi
     fi
 
@@ -81,7 +88,7 @@ case "$1" in
         MESSAGE=$"Generating SSL certificates for"
         dialog "$MESSAGE"
 
-	for server in WWW API BOOT ; do
+	for server in WWW API BOOT MONITOR; do
 	    eval "a=\$PLC_${server}_ENABLED"
             echo $a
             if [ "$a" -ne 1 ] ; then
@@ -96,7 +103,7 @@ case "$1" in
 
 	    # Check if we have already generated a certificate for
 	    # the same hostname.
-	    for previous_server in WWW API BOOT ; do
+	    for previous_server in WWW API BOOT MONITOR; do
 		if [ "$server" = "$previous_server" ] ; then
 		    break
 		fi
@@ -123,20 +130,27 @@ case "$1" in
 	# 4) and /etc/httpd/conf (Fedora Core 2). If the API, boot,
 	# and web servers are all running on the same machine, the web
 	# server certificate takes precedence.
-	for server in API BOOT WWW ; do
+	for server in API BOOT MONITOR WWW; do
 	    enabled=PLC_${server}_ENABLED
 	    if [ "${!enabled}" != "1" ] ; then
 		continue
 	    fi
 	    ssl_key=PLC_${server}_SSL_KEY
 	    ssl_crt=PLC_${server}_SSL_CRT
+	    ssl_ca_crt=PLC_${server}_CA_SSL_CRT
 
 	    symlink ${!ssl_crt} /etc/pki/tls/certs/localhost.crt
 	    symlink ${!ssl_key} /etc/pki/tls/private/localhost.key
+	    symlink ${!ssl_ca_crt} /etc/pki/tls/certs/server-chain.crt
 	    symlink ${!ssl_crt} /etc/httpd/conf/ssl.crt/server.crt
 	    symlink ${!ssl_key} /etc/httpd/conf/ssl.key/server.key
 	done
 
+	# Ensure that the server-chain gets used, as it is off by
+	# default.
+	sed -i -e 's/^#SSLCertificateChainFile /SSLCertificateChainFile /' \
+	    /etc/httpd/conf.d/ssl.conf
+
 	result "$MESSAGE"
 	;;
 esac