Changeset 1768 for trunk/server/fedora/config/etc/httpd/vhosts.d/reify-vhost.py

Timestamp:

Jan 2, 2011, 8:12:11 PM (14 years ago)

Author:

geofft

Message:

Rename current scripts.key to scripts-1024.key.

* httpd.conf: Default to scripts-1024.key for now.
* Blue Sun vhosts: Refer to scripts.key instead of scripts-new.key.
* reify-vhost: Add SSLCertificateKeyFile scripts.key for now for
  newly-reified vhosts, and a comment about what we're doing.

File:

• trunk/server/fedora/config/etc/httpd/vhosts.d/reify-vhost.py (modified) (3 diffs)

trunk/server/fedora/config/etc/httpd/vhosts.d/reify-vhost.py

@@ -12 +12 @@
 # 
 # Geoffrey Thomas <geofft@mit.edu>, 2008, public domain.
+
+# Note: As of 1/2011 we are inserting SSLCertificateKeyFile into reified
+# hosts, because previously-acqured certificates were signed with an
+# older (1024-bit) key. Sometime around 2014 when our last cert with
+# this key expires, we can update /etc/httpd/conf/httpd.conf to point to
+# the current key instead of the old one, and stop inserting this into
+# individual vhost records. -geofft
 
 import ldap
@@ -56 +63 @@
                 Include conf.d/vhosts-common-ssl.conf
                 SSLCertificateFile /etc/pki/tls/certs/%(hname)s.pem
+                SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
         </VirtualHost>
         <VirtualHost *:444>
@@ -66 +74 @@
                 Include conf.d/vhosts-common-ssl-cert.conf
                 SSLCertificateFile /etc/pki/tls/certs/%(hname)s.pem
+                SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
         </VirtualHost>
 </IfModule>""" % {