--- doc/loncapafiles/updatequery.piml	2017/05/19 00:56:34	1.88
+++ doc/loncapafiles/updatequery.piml	2024/07/06 16:00:22	1.98
@@ -1,6 +1,6 @@
 <!-- updatequery.piml -->
 
-<!-- $Id: updatequery.piml,v 1.88 2017/05/19 00:56:34 raeburn Exp $ -->
+<!-- $Id: updatequery.piml,v 1.98 2024/07/06 16:00:22 raeburn Exp $ -->
 
 <!--
 
@@ -62,7 +62,7 @@ sub get_new_sslkeypass {
 sub get_static_config {
 # get LCperlvars from loncapa_apache.conf
     my $confdir = '/etc/httpd/conf/';
-    if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16') {
+    if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'sles15' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16' || '<DIST />' eq 'ubuntu18' || '<DIST />' eq 'ubuntu20' || '<DIST />' eq 'ubuntu22' || '<DIST />' eq 'ubuntu24' || '<DIST />' eq 'debian10' || '<DIST />' eq 'debian11' || '<DIST />' eq 'debian12') {
         $confdir = '/etc/apache2/';
     }
     my $filename='loncapa_apache.conf';
@@ -537,8 +537,8 @@ sub get_ssldesc {
 }
 
 sub get_cert_status {
-    my ($lonHostID,$perlvarstatic) = @_;
-    my $currcerts = &LONCAPA::SSL::print_certstatus({$lonHostID =&gt; 1,},'text','cgi');
+    my ($lonHostID,$hostname,$perlvarstatic) = @_;
+    my $currcerts = &LONCAPA::SSL::print_certstatus({$lonHostID =&gt; $hostname,},'text','install');
     my ($lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,%sslstatus);
     my $output = '';
     if ($currcerts eq "$lonHostID:error") {
@@ -553,13 +553,18 @@ sub get_cert_status {
     } else {
         my %sslnames = &get_sslnames();
         my %ssldesc = &get_ssldesc();
+        my %csr;
         my ($lonhost,$info) = split(/\:/,$currcerts,2);
         if ($lonhost eq $lonHostID) {
             my @items = split(/\&/,$info);
             foreach my $item (@items) {
                 my ($key,$value) = split(/=/,$item,2);
+                if ($key =~ /^(host(?:|name))\-csr$/) {
+                    $csr{$1} = $value;
+                }
                 my @data = split(/,/,$value);
                 if (grep(/^\Q$key\E$/,keys(%sslnames))) {
+                    my ($checkcsr,$comparecsr);
                     if (lc($data[0]) eq 'yes') {
                         $output .= "$ssldesc{$key} ".$perlvarstatic-&gt;{$sslnames{$key}}." available with status = $data[1]\n";
                         if ($key eq 'key') {
@@ -587,6 +592,9 @@ sub get_cert_status {
                                         $lonhostnamecertstatus = "status: created with missing key";
                                     }
                                 }
+                                if ($setstatus) {
+                                    $comparecsr = 1;
+                                }
                             }
                             unless ($setstatus) {
                                 if ($data[1] eq 'expired') {
@@ -606,18 +614,25 @@ sub get_cert_status {
                     } else {
                         $sslstatus{$key} = 0;
                         $output .= "$ssldesc{$key} ".$perlvarstatic-&gt;{$sslnames{$key}}." not available\n";
-                        if (($key eq 'host') || ($key eq 'hostname')) {
-                            my $csr = $perlvarstatic-&gt;{$sslnames{$key}};
-                            $csr =~s /\.pem$/.csr/;
-                            my $csrstatus;
-                            if (-e $perlvarstatic-&gt;{'lonCertificateDirectory'}."/$csr") {
-                                open(PIPE,"openssl req -text -noout -verify -in ".$perlvarstatic-&gt;{'lonCertificateDirectory'}."/$csr 2&gt;&1 |");
-                                while(&lt;PIPE&gt;) {
-                                    chomp();
-                                    $csrstatus = $_;
-                                    last;
-                                }
-                                close(PIPE);
+                        if ($key eq 'key') {
+                            $lonkeystatus = 'still needed';
+                        } elsif (($key eq 'host') || ($key eq 'hostname')) {
+                            $checkcsr = 1;
+                        }
+                    }
+                    if (($checkcsr) || ($comparecsr)) {
+                        my $csrfile = $perlvarstatic-&gt;{$sslnames{$key}};
+                        $csrfile =~s /\.pem$/.csr/;
+                        my $csrstatus;
+                        if (-e $perlvarstatic-&gt;{'lonCertificateDirectory'}."/$csrfile") {
+                            open(PIPE,"openssl req -text -noout -verify -in ".$perlvarstatic-&gt;{'lonCertificateDirectory'}."/$csrfile 2&gt;&1 |");
+                            while(&lt;PIPE&gt;) {
+                                chomp();
+                                $csrstatus = $_;
+                                last;
+                            }
+                            close(PIPE);
+                            if ((($comparecsr) && ($csr{$key})) || ($checkcsr)) {
                                 $output .= "Certificate signing request for $ssldesc{$key} available with status = $csrstatus\n\n";
                                 if ($key eq 'host') {
                                     $lonhostcertstatus = 'awaiting signature';
@@ -625,16 +640,14 @@ sub get_cert_status {
                                     $lonhostnamecertstatus = 'awaiting signature';
                                 }
                                 $sslstatus{$key} = 3;
+                            }
+                        } elsif ($checkcsr) {
+                            $output .= "No certificate signing request available for $ssldesc{$key}\n\n";
+                            if ($key eq 'host') {
+                                $lonhostcertstatus = 'still needed';
                             } else {
-                                $output .= "No certificate signing request available for $ssldesc{$key}\n\n";
-                                if ($key eq 'host') {
-                                    $lonhostcertstatus = 'still needed';
-                                } else {
-                                    $lonhostnamecertstatus = 'still needed';
-                                }
+                                $lonhostnamecertstatus = 'still needed';
                             }
-                        } elsif ($key eq 'key') {
-                            $lonkeystatus = 'still needed';
                         }
                     }
                 }
@@ -1288,7 +1301,7 @@ END
 
 # update loncapa.conf
 my $confdir = '/etc/httpd/conf/';
-if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16') {
+if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'sles15' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16' || '<DIST />' eq 'ubuntu18' || '<DIST />' eq 'ubuntu20' || '<DIST />' eq 'ubuntu22' || '<DIST />' eq 'ubuntu24' || '<DIST />' eq 'debian10' || '<DIST />' eq 'debian11' || '<DIST />' eq 'debian12') {
      $confdir = '/etc/apache2/';
 }   
 my $filename='loncapa.conf';
@@ -1345,7 +1358,7 @@ END
 </file>
 <file>
 <target dist='default'>/etc/httpd/conf/</target>
-<target dist='sles10 sles11 sles12 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2 debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12 ubuntu14 ubuntu16'>/etc/apache2/</target>
+<target dist='sles10 sles11 sles12 sles15 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2 debian5 debian6 debian10 debian11 debian12 ubuntu6 ubuntu8 ubuntu10 ubuntu12 ubuntu14 ubuntu16 ubuntu18 ubuntu20 ubuntu22 ubuntu24'>/etc/apache2/</target>
 <perlscript mode='fg'>
 # read values from loncapa.conf
 my $confdir = "<TARGET />";
@@ -1601,7 +1614,7 @@ if ($supportmail) {
 
 print "\nRetrieving status information for SSL key and certificates ...\n\n";
 my ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) = 
-    &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+    &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
 print $certinfo;
 my %sslstatus;
 if (ref($sslref) eq 'HASH') {
@@ -1918,7 +1931,7 @@ END
           &make_key($certsdir,$privkey,$sslkeypass);
           print "\nRetrieving status information for SSL key and certificates ...\n\n";
           ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-             &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+             &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
           if (ref($sslref) eq 'HASH') {
               %sslstatus = %{$sslref};
           }
@@ -1957,7 +1970,7 @@ END
               &mail_csr('host',$lonCluster,$perlvar{'lonHostID'},$desiredhostname,$certsdir,$connectcsr,$replicatecsr,$perlvarstatic);
               print "\nRetrieving status information for SSL key and certificates ...\n\n";
               ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-                  &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+                  &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
               if (ref($sslref) eq 'HASH') {
                   %sslstatus = %{$sslref};
               }
@@ -2002,7 +2015,7 @@ END
           &mail_csr('host',$lonCluster,$perlvar{'lonHostID'},$desiredhostname,$certsdir,$connectcsr,$replicatecsr,$perlvarstatic);
           print "\nRetrieving status information for SSL key and certificates ...\n\n";
           ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-              &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+              &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
           if (ref($sslref) eq 'HASH') {
               %sslstatus = %{$sslref};
           }
@@ -2039,7 +2052,7 @@ END
               &mail_csr('hostname',$lonCluster,$perlvar{'lonHostID'},$desiredhostname,$certsdir,$connectcsr,$replicatecsr,$perlvarstatic);
               print "\nRetrieving status information for SSL key and certificates ...\n\n";
               ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-                  &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+                  &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
               if (ref($sslref) eq 'HASH') {
                   %sslstatus = %{$sslref};
               }
@@ -2084,7 +2097,7 @@ END
           &mail_csr('hostname',$lonCluster,$perlvar{'lonHostID'},$desiredhostname,$certsdir,$connectcsr,$replicatecsr,$perlvarstatic);
           print "\nRetrieving status information for SSL key and certificates ...\n\n";
           ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-              &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+              &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
           if (ref($sslref) eq 'HASH') {
               %sslstatus = %{$sslref};
           }