[LON-CAPA-cvs] cvs: doc /install/linux install.pl
raeburn
raeburn at source.lon-capa.org
Sun Sep 13 16:21:25 EDT 2026
raeburn Sun Sep 13 20:21:25 2026 EDT
Modified files:
/doc/install/linux install.pl
Log:
- Contents of loncapassl.conf only added to Apache config file if
SSLCertificateFile, SSLCertificateKeyFile, SSLCACertificateFile,
and SSLCARevocationFile all already exist.
Index: doc/install/linux/install.pl
diff -u doc/install/linux/install.pl:1.103 doc/install/linux/install.pl:1.104
--- doc/install/linux/install.pl:1.103 Sat Aug 8 22:44:55 2026
+++ doc/install/linux/install.pl Sun Sep 13 20:21:25 2026
@@ -78,7 +78,7 @@
&mt('Stopping execution.')."\n";
exit;
} else {
- print LOG '$Id: install.pl,v 1.103 2026/08/08 22:44:55 raeburn Exp $'."\n";
+ print LOG '$Id: install.pl,v 1.104 2026/09/13 20:21:25 raeburn Exp $'."\n";
}
#
@@ -1279,7 +1279,7 @@
#
# chkapachessl() determines whether a server's Apache SSL configuration
-# needs updating to support LON-CAPA.
+# should be updated to support LON-CAPA.
#
# LON-CAPA uses VirtualHosts for port 443, and requires that they are
# defined in one Apache configuration file containing two VirtualHost
@@ -3548,9 +3548,9 @@
# which will respond to client browser requests for https:// pages.
#
# Accordingly, a system administrator will need to edit the config
-# config file to include paths to a signed SSL certificate (public),
+# file to include paths to a signed SSL certificate (public),
# chain (public) and key (private) pem files. The certificate should
-# have been signed by a recognized certificate authority ((e.g.,
+# have been signed by a recognized certificate authority (e.g.,
# InCommon or Let's Encrypt).
#
# The sslrewrite.conf file contains the rewrite configuration for
@@ -3574,6 +3574,12 @@
# SSL client certificate, signed by the certificate authority
# for the LON-CAPA network to which the node belongs.
#
+# As the config for the "internal" virtual host requires that
+# four files: lonhostnamecert.pem, lonKey.pem, loncapaCA.pem,
+# and loncapaCAcrl.pem already exist in /home/httpd/lonCerts
+# no "internal" virtual host block will be added unless all of
+# those files exist.
+#
# The configuration file to which the contents of sslrewrite.conf
# and loncapassl.conf will be written will have either been identified
# when &chkapachessl() was run, or if no files were found with
@@ -3590,8 +3596,7 @@
#
# Once a file is selected, the contents of sslrewrite.conf and
# loncapassl.conf are compared with appropriate blocks in the file
-# and the user will be prompted to agree to insertion of missing lines
-# and/or deletion of surplus lines.
+# and missing lines will be inserted.
#
sub copy_apache_sslconf_files {
@@ -3600,6 +3605,13 @@
my ($new_std,$new_int);
my (@internal, at standard,%int_by_linenum,%int_by_linetext,
%rule_by_linenum,%rule_by_linetext,%foundint);
+ my ($gotcerts,$missing_loncapassl,$missing_sslrewrite,$noread_loncapassl,
+ $noread_sslrewrite);
+ my $certdir = '/home/httpd/lonCerts';
+ if ((-e "$certdir/lonhostnamecert.pem") && (-e "$certdir/lonKey.pem") &&
+ (-e "$certdir/loncapaCA.pem") && (-e "$certdir/loncapaCAcrl.pem")) {
+ $gotcerts = 1;
+ }
if (-e "$instdir/loncapassl.conf") {
if (open(my $fh,'<',"$instdir/loncapassl.conf")) {
my $num = 1;
@@ -3615,7 +3627,11 @@
$num ++;
}
close($fh);
+ } else {
+ $noread_loncapassl = 1;
}
+ } else {
+ $missing_loncapassl = 1;
}
if (-e "$instdir/sslrewrite.conf") {
if (open(my $fh,'<',"$instdir/sslrewrite.conf")) {
@@ -3632,7 +3648,11 @@
$num ++;
}
close($fh);
+ } else {
+ $noread_sslrewrite = 1;
}
+ } else {
+ $missing_sslrewrite = 1;
}
if (!$nochgstd) {
if ($has_std eq '') {
@@ -3662,7 +3682,7 @@
}
}
}
- if (!$nochgint) {
+ if ((!$nochgint) && ($gotcerts)) {
if ($has_int eq '') {
if ($has_std ne '') {
if (open(my $fhout,'>>',"$targetdir/$has_std")) {
@@ -3682,19 +3702,23 @@
print $fhout "<VirtualHost *:443>\n".
"ServerName $hostname\n".
join("\n", at standard)."\n".
- "</VirtualHost>\n\n".
- join("\n", at internal)."\n";
- close($fhout);
+ "</VirtualHost>\n";
$new_std = $file;
- $new_int = $file;
+ if ($gotcerts) {
+ print $fhout "\n".join("\n", at internal)."\n";
+ $new_int = $file;
+ }
+ close($fhout);
}
} elsif ($numfiles == 1) {
&append_to_vhost($targetdir,$file,$hostname,\%rule_by_linenum,'std');
- if (open(my $fhout, '>>', "$targetdir/$file")) {
- print $fhout "\n".join("\n", at internal)."\n";
- close($fhout);
- $new_std = $file;
- $new_int = $file;
+ $new_std = $file;
+ if ($gotcerts) {
+ if (open(my $fhout, '>>', "$targetdir/$file")) {
+ print $fhout "\n".join("\n", at internal)."\n";
+ close($fhout);
+ $new_int = $file;
+ }
}
} elsif ($numfiles == -1) {
print_and_log(&mt('Failed to copy contents of [_1] or [_2] to a file in [_3]',
@@ -3709,13 +3733,19 @@
print_and_log(&mt('No change required to file: [_1] in [_2], (no difference between [_3] and virtualhost block.)',
"'$has_int'","'$targetdir'","'loncapassl.conf'"));
}
- if ($new_int) {
+ if (!$gotcerts) {
+ print_and_log(&mt('Contents of [_1] *not* copied to [_2] because required certificate and/or key are missing from [_3].',"'loncapassl.conf'","'$targetdir/$new_int'","'$certdir'")."\n".
+ &mt('Note: when you install or update the LON-CAPA application itself you will be prompted to create a key and/or send certificate signing request(s) to the LON-CAPA Certificate Authority (CA), unless you have already done so.')."\n".
+ &mt('Once the CA returns your signed certificates via email, follow the instructions in the email to populate [_1] and then run this install.pl script again and select "Y" for the "Configure SSL for Apache web server?" option.',"'$certdir'")."\n");
+ } elsif ($new_int) {
print_and_log(&mt('Successfully copied contents of [_1] to [_2].',"'loncapassl.conf'","'$targetdir/$new_int'")."\n");
- chmod(0444,"$targetdir/loncapassl.conf");
+ chmod(0444,"$targetdir/$new_int");
}
if ($new_std) {
print_and_log(&mt('Successfully copied contents of [_1] to [_2].',"'sslrewrite.conf'","'$targetdir/$new_std'")."\n");
- chmod(0444,"$targetdir/loncapassl.conf");
+ unless (($gotcerts) && ($new_int eq $new_std)) {
+ chmod(0444,"$targetdir/$new_std");
+ }
}
return ($new_int,$new_std);
}
More information about the LON-CAPA-cvs
mailing list