httpd/httpd-init.service

[Unit]
Description=One-time temporary TLS key generation for httpd.service
Documentation=man:httpd-init.service(8)

ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt
ConditionPathExists=|!/etc/pki/tls/private/localhost.key

[Service]
Type=oneshot
RemainAfterExit=no

ExecStart=/usr/libexec/httpd-ssl-gencerts
Generate SSL keys on service start This defers the creation of self-signed SSL certificates to the first time that httpd starts up. This has several advantages: * Waiting until the first boot will help avoid some issues with limited entropy in the install process. * The certificates can be regenerated automatically whenever they are removed, which helps with tools such as virt-sysprep * The certificates are now generated by SSCG, which produces a limited-trust CA alongside it that can be safely imported by a client. For more information on SSCG, see: https://sgallagh.wordpress.com/2016/05/02/self-signed-ssltls-certificates-why-they-are-terrible-and-a-better-alternative/ Signed-off-by: Stephen Gallagher <sgallagh@redhat.com> 2017-09-20 18:18:24 +00:00			`[Unit]`
Remove condition on localhost-ca.crt, tweak description. 2017-09-22 07:04:10 +00:00			`Description=One-time temporary TLS key generation for httpd.service`
use sscg defaults; append CA cert to generated cert document httpd-init.service in httpd-init.service(8) 2017-09-21 15:41:20 +00:00			`Documentation=man:httpd-init.service(8)`
Generate SSL keys on service start This defers the creation of self-signed SSL certificates to the first time that httpd starts up. This has several advantages: * Waiting until the first boot will help avoid some issues with limited entropy in the install process. * The certificates can be regenerated automatically whenever they are removed, which helps with tools such as virt-sysprep * The certificates are now generated by SSCG, which produces a limited-trust CA alongside it that can be safely imported by a client. For more information on SSCG, see: https://sgallagh.wordpress.com/2016/05/02/self-signed-ssltls-certificates-why-they-are-terrible-and-a-better-alternative/ Signed-off-by: Stephen Gallagher <sgallagh@redhat.com> 2017-09-20 18:18:24 +00:00
			`ConditionPathExists=\|!/etc/pki/tls/certs/localhost.crt`
			`ConditionPathExists=\|!/etc/pki/tls/private/localhost.key`

			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=no`

			`ExecStart=/usr/libexec/httpd-ssl-gencerts`