httpd.git/httpd-init.service, branch add_tests Unnamed repository; edit this file 'description' to name the repository. Remove condition on localhost-ca.crt, tweak description. 2017-09-22T07:04:10+00:00 Joe Orton jorton@redhat.com 2017-09-22T07:04:10+00:00 87cc93ad9657758149e241e00625016116e514e5 






use sscg defaults; append CA cert to generated cert
2017-09-21T15:41:20+00:00

Joe Orton
jorton@redhat.com

2017-09-21T15:41:20+00:00

6a777617406defe19df7a85b86427f1f3e0c3384

document httpd-init.service in httpd-init.service(8)





document httpd-init.service in httpd-init.service(8)







Generate SSL keys on service start
2017-09-20T19:00:20+00:00

Stephen Gallagher
sgallagh@redhat.com

2017-09-20T18:18:24+00:00

180ad320f452c4c58f6edc75a5749f665bf7459f

This defers the creation of self-signed SSL certificates to the
first time that httpd starts up. This has several advantages:

* Waiting until the first boot will help avoid some issues with
  limited entropy in the install process.
* The certificates can be regenerated automatically whenever they
  are removed, which helps with tools such as virt-sysprep
* The certificates are now generated by SSCG, which produces a
  limited-trust CA alongside it that can be safely imported by a
  client.

For more information on SSCG, see:
https://sgallagh.wordpress.com/2016/05/02/self-signed-ssltls-certificates-why-they-are-terrible-and-a-better-alternative/

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>





This defers the creation of self-signed SSL certificates to the
first time that httpd starts up. This has several advantages:

* Waiting until the first boot will help avoid some issues with
  limited entropy in the install process.
* The certificates can be regenerated automatically whenever they
  are removed, which helps with tools such as virt-sysprep
* The certificates are now generated by SSCG, which produces a
  limited-trust CA alongside it that can be safely imported by a
  client.

For more information on SSCG, see:
https://sgallagh.wordpress.com/2016/05/02/self-signed-ssltls-certificates-why-they-are-terrible-and-a-better-alternative/

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>