From 82cb6c4cb1bea5f728276781f826484604af5a7b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 8 Aug 2026 16:53:09 +0000
Subject: [PATCH 1/3] Replace snakeoil ssl-cert with newcert script for
 self-signed TLS certificate

Co-authored-by: ohanssen <2892992+ohanssen@users.noreply.github.com>
---
 debian/control                 |  2 +-
 debian/misc/aprs_ssl.conf      | 11 +++---
 debian/misc/newcert            | 71 ++++++++++++++++++++++++++++++++++
 debian/polaric-webapp2.install |  1 +
 debian/postinst                |  4 ++
 5 files changed, 83 insertions(+), 6 deletions(-)
 create mode 100644 debian/misc/newcert

diff --git a/debian/control b/debian/control
index 84498d97..8e26bebf 100644
--- a/debian/control
+++ b/debian/control
@@ -9,7 +9,7 @@ Homepage: http://aprs.no/polaricserver
 Package: polaric-webapp2
 Architecture: all
 Pre-Depends: acl, adduser
-Depends: apache2, apache2-utils, libapache2-mod-mapcache, mapcache-tools, openssl, ssl-cert, javascript-common, libjs-jquery, libjs-jquery-ui, ${misc:Depends}
+Depends: apache2, apache2-utils, libapache2-mod-mapcache, mapcache-tools, openssl, javascript-common, libjs-jquery, libjs-jquery-ui, ${misc:Depends}
 Recommends:  polaric-aprsd (>= 4.2)
 Conflicts: polaric-webapp, polaric-aprsd (<< 4.2)
 Description: Polaric Server: Web application. 
diff --git a/debian/misc/aprs_ssl.conf b/debian/misc/aprs_ssl.conf
index b6d1ab6c..25ca5487 100644
--- a/debian/misc/aprs_ssl.conf
+++ b/debian/misc/aprs_ssl.conf
@@ -17,14 +17,15 @@
 
 #############################################################
 # SSL/TLS setup 
-# Use self-signed snakeoil certificates by default. It is 
-# recommended to use certificates signed by a CA if you have 
-# more than a few users. For examle from lets encrypt. 
+# Use a self-signed certificate generated by the newcert
+# script by default. It is recommended to use certificates
+# signed by a CA if you have more than a few users.
+# For example from Let's Encrypt.
 #############################################################
 
 SSLEngine on
-SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
-SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
+SSLCertificateFile /etc/polaric/ssl/polaric.crt
+SSLCertificateKeyFile /etc/polaric/ssl/polaric.key
 
 #
 # Setup of TLS protocols and ciphers supports a high level of security. 
diff --git a/debian/misc/newcert b/debian/misc/newcert
new file mode 100644
index 00000000..f00eaefa
--- /dev/null
+++ b/debian/misc/newcert
@@ -0,0 +1,71 @@
+#!/bin/bash
+#
+# newcert - Generate a self-signed TLS certificate for the Polaric Server
+# frontend web-server (Apache).
+#
+# If the Polaric-aprsd backend is installed and a callsign (mycall) is
+# configured in /etc/polaric-aprsd/server.ini, the certificate Common Name
+# (CN) will be set to  polaric-<callsign>  (e.g. polaric-la7eca).
+# Otherwise the system hostname is used.
+#
+# Certificate files are written to:
+#   /etc/polaric/ssl/polaric.crt   (certificate)
+#   /etc/polaric/ssl/polaric.key   (private key)
+#
+
+set -e
+
+CERT_DIR="/etc/polaric/ssl"
+CERT_FILE="$CERT_DIR/polaric.crt"
+KEY_FILE="$CERT_DIR/polaric.key"
+APRSD_CONF="/etc/polaric-aprsd/server.ini"
+
+# ---- Determine the Common Name ----
+CN=""
+
+if [[ -f "$APRSD_CONF" ]]; then
+    # Look for a line like:  mycall = LA7ECA-5
+    # Strip SSID (-N suffix) and convert to lowercase
+    CALLSIGN=$(grep -i '^\s*mycall\s*=' "$APRSD_CONF" 2>/dev/null \
+        | head -1 \
+        | sed 's/.*=\s*//' \
+        | tr -d '[:space:]' \
+        | tr 'A-Z' 'a-z' \
+        | sed 's/-[0-9]*$//')
+    if [[ -n "$CALLSIGN" ]]; then
+        CN="polaric-${CALLSIGN}"
+    fi
+fi
+
+if [[ -z "$CN" ]]; then
+    CN="$(hostname -f 2>/dev/null || hostname)"
+fi
+
+echo "Generating self-signed certificate for CN=$CN ..."
+
+# ---- Create certificate directory ----
+mkdir -p "$CERT_DIR"
+chmod 750 "$CERT_DIR"
+
+# ---- Generate private key and self-signed certificate ----
+openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 \
+    -nodes \
+    -keyout "$KEY_FILE" \
+    -out "$CERT_FILE" \
+    -subj "/CN=$CN" \
+    -addext "subjectAltName=DNS:$CN" \
+    2>/dev/null
+
+chmod 640 "$KEY_FILE"
+chmod 644 "$CERT_FILE"
+
+# Ensure www-data (Apache) can read the key
+if getent group ssl-cert > /dev/null 2>&1; then
+    chown root:ssl-cert "$KEY_FILE"
+else
+    chown root:root "$KEY_FILE"
+fi
+
+echo "Certificate installed:"
+echo "  $CERT_FILE"
+echo "  $KEY_FILE"
diff --git a/debian/polaric-webapp2.install b/debian/polaric-webapp2.install
index a547de0f..4fae36bd 100644
--- a/debian/polaric-webapp2.install
+++ b/debian/polaric-webapp2.install
@@ -1 +1,2 @@
  debian/misc/aprs_ssl.conf  etc/apache2/sites-available
+debian/misc/newcert  usr/sbin
diff --git a/debian/postinst b/debian/postinst
index 08821856..b7aadb4b 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -21,6 +21,10 @@ case "$1" in
         a2enmod proxy_http > /dev/null 2>&1
         a2enmod headers > /dev/null 2>&1
         a2enmod proxy_wstunnel > /dev/null 2>&1
+
+        if [[ ! -f "/etc/polaric/ssl/polaric.crt" ]]; then
+            /usr/sbin/newcert
+        fi
         
         if [[ -f "/etc/apache2/sites-enabled/aprs.conf" ]]; then
             if [[ -f "/etc/apache2/sites-available/aprs.conf" ]]; then

From 063108b9cd34572557c92458680bf7bca8d223cc Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 8 Aug 2026 16:54:18 +0000
Subject: [PATCH 2/3] Address code review: fix newcert permissions, add CN
 sanitization

Co-authored-by: ohanssen <2892992+ohanssen@users.noreply.github.com>
---
 debian/misc/newcert | 8 ++++++++
 1 file changed, 8 insertions(+)
 mode change 100644 => 100755 debian/misc/newcert

diff --git a/debian/misc/newcert b/debian/misc/newcert
old mode 100644
new mode 100755
index f00eaefa..5de5cba7
--- a/debian/misc/newcert
+++ b/debian/misc/newcert
@@ -41,6 +41,14 @@ if [[ -z "$CN" ]]; then
     CN="$(hostname -f 2>/dev/null || hostname)"
 fi
 
+# Sanitize CN: allow only alphanumeric characters, hyphens and dots
+CN=$(echo "$CN" | tr -cd 'a-zA-Z0-9.-' | tr 'A-Z' 'a-z')
+
+# Fallback in case sanitization leaves an empty string
+if [[ -z "$CN" ]]; then
+    CN="polaric"
+fi
+
 echo "Generating self-signed certificate for CN=$CN ..."
 
 # ---- Create certificate directory ----

From 0e32e6b784b5a2139a4c61e5fbfee0dcf51a3814 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 8 Aug 2026 16:56:29 +0000
Subject: [PATCH 3/3] newcert: switch to P-384 elliptic curve certificate
 (replaces RSA 4096)

Co-authored-by: ohanssen <2892992+ohanssen@users.noreply.github.com>
---
 debian/misc/newcert | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/debian/misc/newcert b/debian/misc/newcert
index 5de5cba7..87b402ea 100755
--- a/debian/misc/newcert
+++ b/debian/misc/newcert
@@ -55,9 +55,10 @@ echo "Generating self-signed certificate for CN=$CN ..."
 mkdir -p "$CERT_DIR"
 chmod 750 "$CERT_DIR"
 
-# ---- Generate private key and self-signed certificate ----
-openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 \
-    -nodes \
+# ---- Generate EC private key and self-signed certificate ----
+# Uses NIST P-384 (secp384r1) elliptic curve.
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-384 -sha256 -days 3650 \
+    -noenc \
     -keyout "$KEY_FILE" \
     -out "$CERT_FILE" \
     -subj "/CN=$CN" \