Replace ssl-cert snakeoil dependency with custom newcert script

debian/control

@@ -9,7 +9,7 @@ Homepage: http://aprs.no/polaricserver
 Package: polaric-webapp2
 Architecture: all
 Pre-Depends: acl, adduser
-Depends: apache2, apache2-utils, libapache2-mod-mapcache, mapcache-tools, openssl, ssl-cert, javascript-common, libjs-jquery, libjs-jquery-ui, ${misc:Depends}
+Depends: apache2, apache2-utils, libapache2-mod-mapcache, mapcache-tools, openssl, javascript-common, libjs-jquery, libjs-jquery-ui, ${misc:Depends}
 Recommends:  polaric-aprsd (>= 4.2)
 Conflicts: polaric-webapp, polaric-aprsd (<< 4.2)
 Description: Polaric Server: Web application. 

debian/misc/aprs_ssl.conf

@@ -17,14 +17,15 @@
 
 #############################################################
 # SSL/TLS setup 
-# Use self-signed snakeoil certificates by default. It is 
-# recommended to use certificates signed by a CA if you have 
-# more than a few users. For examle from lets encrypt. 
+# Use a self-signed certificate generated by the newcert
+# script by default. It is recommended to use certificates
+# signed by a CA if you have more than a few users.
+# For example from Let's Encrypt.
 #############################################################
 
 SSLEngine on
-SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
-SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
+SSLCertificateFile /etc/polaric/ssl/polaric.crt
+SSLCertificateKeyFile /etc/polaric/ssl/polaric.key
 
 #
 # Setup of TLS protocols and ciphers supports a high level of security. 

debian/misc/newcert

@@ -0,0 +1,80 @@
+#!/bin/bash
+#
+# newcert - Generate a self-signed TLS certificate for the Polaric Server
+# frontend web-server (Apache).
+#
+# If the Polaric-aprsd backend is installed and a callsign (mycall) is
+# configured in /etc/polaric-aprsd/server.ini, the certificate Common Name
+# (CN) will be set to  polaric-<callsign>  (e.g. polaric-la7eca).
+# Otherwise the system hostname is used.
+#
+# Certificate files are written to:
+#   /etc/polaric/ssl/polaric.crt   (certificate)
+#   /etc/polaric/ssl/polaric.key   (private key)
+#
+
+set -e
+
+CERT_DIR="/etc/polaric/ssl"
+CERT_FILE="$CERT_DIR/polaric.crt"
+KEY_FILE="$CERT_DIR/polaric.key"
+APRSD_CONF="/etc/polaric-aprsd/server.ini"
+
+# ---- Determine the Common Name ----
+CN=""
+
+if [[ -f "$APRSD_CONF" ]]; then
+    # Look for a line like:  mycall = LA7ECA-5
+    # Strip SSID (-N suffix) and convert to lowercase
+    CALLSIGN=$(grep -i '^\s*mycall\s*=' "$APRSD_CONF" 2>/dev/null \
+        | head -1 \
+        | sed 's/.*=\s*//' \
+        | tr -d '[:space:]' \
+        | tr 'A-Z' 'a-z' \
+        | sed 's/-[0-9]*$//')
+    if [[ -n "$CALLSIGN" ]]; then
+        CN="polaric-${CALLSIGN}"
+    fi
+fi
+
+if [[ -z "$CN" ]]; then
+    CN="$(hostname -f 2>/dev/null || hostname)"
+fi
+
+# Sanitize CN: allow only alphanumeric characters, hyphens and dots
+CN=$(echo "$CN" | tr -cd 'a-zA-Z0-9.-' | tr 'A-Z' 'a-z')
+
+# Fallback in case sanitization leaves an empty string
+if [[ -z "$CN" ]]; then
+    CN="polaric"
+fi
+
+echo "Generating self-signed certificate for CN=$CN ..."
+
+# ---- Create certificate directory ----
+mkdir -p "$CERT_DIR"
+chmod 750 "$CERT_DIR"
+
+# ---- Generate EC private key and self-signed certificate ----
+# Uses NIST P-384 (secp384r1) elliptic curve.
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-384 -sha256 -days 3650 \
+    -noenc \
+    -keyout "$KEY_FILE" \
+    -out "$CERT_FILE" \
+    -subj "/CN=$CN" \
+    -addext "subjectAltName=DNS:$CN" \
+    2>/dev/null
+
+chmod 640 "$KEY_FILE"
+chmod 644 "$CERT_FILE"
+
+# Ensure www-data (Apache) can read the key
+if getent group ssl-cert > /dev/null 2>&1; then
+    chown root:ssl-cert "$KEY_FILE"
+else
+    chown root:root "$KEY_FILE"
+fi
+
+echo "Certificate installed:"
+echo "  $CERT_FILE"
+echo "  $KEY_FILE"

debian/polaric-webapp2.install

@@ -1 +1,2 @@
  debian/misc/aprs_ssl.conf  etc/apache2/sites-available
+debian/misc/newcert  usr/sbin

debian/postinst

@@ -21,6 +21,10 @@ case "$1" in
         a2enmod proxy_http > /dev/null 2>&1
         a2enmod headers > /dev/null 2>&1
         a2enmod proxy_wstunnel > /dev/null 2>&1
+
+        if [[ ! -f "/etc/polaric/ssl/polaric.crt" ]]; then
+            /usr/sbin/newcert
+        fi
 
         if [[ -f "/etc/apache2/sites-enabled/aprs.conf" ]]; then
             if [[ -f "/etc/apache2/sites-available/aprs.conf" ]]; then