--- doc/loncapafiles/updatequery.piml	2016/07/29 16:44:36	1.82
+++ doc/loncapafiles/updatequery.piml	2016/08/03 15:04:59	1.85
@@ -1,6 +1,6 @@
 <!-- updatequery.piml -->
 
-<!-- $Id: updatequery.piml,v 1.82 2016/07/29 16:44:36 raeburn Exp $ -->
+<!-- $Id: updatequery.piml,v 1.85 2016/08/03 15:04:59 raeburn Exp $ -->
 
 <!--
 
@@ -33,7 +33,17 @@ http://www.lon-capa.org/
 <target dist='default'>/</target>
 <perlscript mode='fg'>
 $|=1;
-  use strict;
+use strict;
+use lib '/home/httpd/lib/perl/';
+use LONCAPA::Configuration;
+use LONCAPA::Lond;
+use LONCAPA::SSL;
+use LONCAPA;
+use GDBM_File;
+use Storable qw(thaw);
+use Term::ReadKey;
+use Locale::Country;
+
   print(&lt;&lt;END);
 
 
@@ -49,26 +59,202 @@ $|=1;
 
 END
 #sleep(3);
+
+sub get_static_config {
+# get LCperlvars from loncapa_apache.conf
+    my $confdir = '/etc/httpd/conf/';
+    if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16') {
+        $confdir = '/etc/apache2/';
+    }
+    my $filename='loncapa_apache.conf';
+    my %LCperlvar;
+    if (-e "$confdir$filename") {
+        open(CONFIG,'&lt;'.$confdir.$filename) or die("Can't read $confdir$filename");
+        while (my $configline=&lt;CONFIG&gt;) {
+            if ($configline =~ /^[^\#]?PerlSetVar/) {
+                my ($unused,$varname,$varvalue)=split(/\s+/,$configline);
+                chomp($varvalue);
+                $LCperlvar{$varname}=$varvalue;
+            }
+        }
+        close(CONFIG);
+    }
+    return \%LCperlvar;
+}
+
+sub get_domain_config {
+    my ($dom,$isprimary,$url,$perlvarref) = @_;
+    my %confhash;
+    if ($isprimary) {
+        if (ref($perlvarref) eq 'HASH') {
+            my $lonusersdir = $perlvarref-&gt;{'lonUsersDir'};
+            my $fname = $lonusersdir.'/'.$dom.'/configuration.db';
+            if (-e $fname) {
+                my $dbref=&LONCAPA::locking_hash_tie($fname,&GDBM_READER());
+                if (ref($dbref) eq 'HASH') {
+                    foreach my $key (sort(keys(%{$dbref}))) {
+                        my $value = $dbref->{$key};
+                        if ($value =~ s/^__FROZEN__//) {
+                            $value = thaw(&LONCAPA::unescape($value));
+                        } else {
+                            $value = &LONCAPA::unescape($value);
+                        }
+                        $confhash{$key} = $value;
+                    }
+                    &LONCAPA::locking_hash_untie($dbref);
+                }
+            }
+        }
+    } else {
+        if (open(PIPE,"wget --no-check-certificate '$url?domain=$dom&format=raw' |")) {
+            my $config = '';
+            while (<PIPE>) {
+                $config .= $_;
+            }
+            close(PIPE);
+            if ($config) {
+                my @pairs=split(/\&/,$config);
+                foreach my $item (@pairs) {
+                    my ($key,$value)=split(/=/,$item,2);
+                    my $what = &LONCAPA::unescape($key);
+                    if ($value =~ s/^__FROZEN__//) {
+                        $value = thaw(&LONCAPA::unescape($value));
+                    } else {
+                        $value = &LONCAPA::unescape($value); 
+                    }
+                    $confhash{$what}=$value;
+                }
+            }
+        }
+    }
+    return (\%confhash);
+}
+
+sub make_passphrase {
+    my ($got_passwd,$firstpass,$secondpass,$passwd);
+    my $maxtries = 10;
+    my $trial = 0;
+    while ((!$got_passwd) && ($trial &lt; $maxtries)) {
+        $firstpass = &get_password('Enter password');
+        if (length($firstpass) &lt; 6) {
+            print('Password too short.'."\n".
+              'Please choose a password with at least six characters.'."\n".
+              'Please try again.'."\n");
+        } elsif (length($firstpass) &gt; 30) {
+            print('Password too long.'."\n".
+                  'Please choose a password with no more than thirty characters.'."\n".
+                  'Please try again.'."\n");
+        } else {
+            my $pbad=0;
+            foreach (split(//,$firstpass)) {if ((ord($_)&lt;32)||(ord($_)&gt;126)){$pbad=1;}}
+            if ($pbad) {
+                print('Password contains invalid characters.'."\n".
+                      'Password must consist of standard ASCII characters.'."\n".
+                      'Please try again.'."\n");
+            } else {
+                $secondpass = &get_password('Enter password a second time');
+                if ($firstpass eq $secondpass) {
+                    $got_passwd = 1;
+                    $passwd = $firstpass;
+                } else {
+                    print('Passwords did not match.'."\n".
+                          'Please try again.'."\n");
+                }
+            }
+        }
+        $trial ++;
+    }
+    return $passwd;
+}
+
+sub get_password {
+    my ($prompt) = @_;
+    local $| = 1;
+    print $prompt.': ';
+    my $newpasswd = '';
+    ReadMode 'raw';
+    my $key;
+    while(ord($key = ReadKey(0)) != 10) {
+        if(ord($key) == 127 || ord($key) == 8) {
+            chop($newpasswd);
+            print "\b \b";
+        } elsif(!ord($key) &lt; 32) {
+            $newpasswd .= $key;
+            print '*';
+        }
+    }
+    ReadMode 'normal';
+    print "\n";
+    return $newpasswd;
+}
+
+sub send_mail {
+    my ($hostname,$recipient,$subj,$file) = @_;
+    my $from = 'www@'.$hostname;
+    my $certmail = "To: $recipient\n".
+                   "From: $from\n".
+                   "Subject: ".$subj."\n".
+                   "Content-type: text/plain\; charset=UTF-8\n".
+                   "MIME-Version: 1.0\n\n";
+    if (open(my $fh,"&lt;$file")) {
+        while (&lt;$fh&gt;) {
+            $certmail .= $_;
+        }
+        close($fh);
+        $certmail .= "\n\n";
+        if (open(my $mailh, "|/usr/lib/sendmail -oi -t -odb")) {
+            print $mailh $certmail;
+            close($mailh);
+            print "Mail sent ($subj) to $recipient\n";
+        } else {
+            print "Sending mail ($subj) to $recipient failed.\n";
+        }
+    }
+    return;
+}
+
 </perlscript>
 </file>
 <file>
-<target dist='default'>loncom/hosts.tab</target>
+<target dist='default'>../../loncom/hosts.tab</target>
 <perlscript mode='fg'>
 my $lonCluster;
-unless (-l "<TARGET />") {
-  print(&lt;&lt;END);
+my $currCluster;
+
+if (-l "<TARGET />") {
+  my $currlink = readlink("<TARGET />");
+  if ($currlink =~ /^new_(existing|standalone|development|production)_hosts\.tab$/) {
+      $currCluster = $1;
+  }
+  my %clustertypes = (
+                       production  => 'PRODUCTION',
+                       standalone  => 'STAND-ALONE',
+                       development => 'DEVELOPMENT',
+                       existing    => 'RUNNING YOUR OWN CLUSTER',
+                     );
+  if (($currCluster) && (exists($clustertypes{$currCluster}))) {
+      print(&lt;&lt;END);
+
+The cluster type for this server is currently: $clustertypes{$currCluster}
+END
+
+  }
+}
+
+print(&lt;&lt;END);
 
 ===============================================================================
+
 Which cluster option would you like to have installed?
 IMPORTANT: to take advantage of the cluster options 1) and 3),
-you must contact lon-capa\@lon-capa.org.
+you must contact loncapa\@loncapa.org.
 
 1) PRODUCTION - you want to eventually connect this machine to the
                 LON-CAPA content sharing network. This setting is for
                 schools, colleges, and universities, that currently
-                are running - or in the future will run - courses
+                are running - or in the future will run - courses.
 2) STAND-ALONE - you want this machine to run in 'stand-alone' mode and
-                 not be connected to other LON-CAPA machines for now
+                 not be connected to other LON-CAPA machines for now.
 3) DEVELOPMENT - you want to do software (not content!) development with
                  this workstation and eventually link it with the
                  workstations of other LON-CAPA software developers.
@@ -116,7 +302,6 @@ END
     $lonCluster='rawhide'; $flag=1;
   }
 }
-}
 </perlscript>
 </file>
 <file>
@@ -128,16 +313,20 @@ my $domainTabExtras;
 my $primaryLibServer;
 my $protocol;
 my $intdom;
+my $desiredhostname;
+my $city;
+my $state;
+my $country;
 my @libservers = ();
 unless (-e "<TARGET />") {
   print(&lt;&lt;END);
            WELCOME TO LON-CAPA!
 
-If you have questions, please visit http://install.lon-capa.org
-or contact helpdesk\@lon-capa.org.
+If you have questions, please visit http://install.loncapa.org
+or contact helpdesk\@loncapa.org.
 
 ===============================================================================
-The following 7 values are needed to configure LON-CAPA:
+The following 10 values are needed to configure LON-CAPA:
 * Machine Role
 * LON-CAPA Domain Name
 * LON-CAPA Machine ID Name
@@ -145,6 +334,9 @@ The following 7 values are needed to con
 * LON-CAPA Domain's Primary Library Server Machine ID
 * Web Server Protocol
 * Internet Domain Name of Your Institution
+* Hostname
+* City, State, Country for LON-CAPA SSL certificate 
+* Password for key for creating SSL certificates
 ===============================================================================
 
 In addition, a Support E-mail Address can also be included. If
@@ -162,8 +354,8 @@ close(OUT);
 **** Machine Role ****
 Library server (recommended if first-time installation of LON-CAPA):
    Servers that are repositories of authoritative educational resources.
-   These servers also provide the construction space by which instructors
-   assemble their classroom online material.
+   These servers also provide the authoring spaces in which content
+   creators (e.g., faculty instructors) create their learning content.
 Access server:
    Servers that load-balance high-traffic delivery of educational resources
    over the world-wide web.
@@ -208,13 +400,13 @@ if ($hostname=~/([^\.]*)\.([^\.]*)$/) {
   print(&lt;&lt;END);
 
 **** Domain ****
-[This does NOT need to correspond to internet address domains.
+[This does NOT need to correspond to an internet address domain.
  Please make this name short AND descriptive of your organization.
  Domain names are close to impossible to change later!!!
  Good examples might be "msu" or "bionet" or "vermontcc".
  Bad examples are "physics" (too general)
    or "michiganstateuniversity" (too long)
-   or "msuedu" (internet domain, just make it "msu")
+   or "msuedu" (just make it "msu", or else make it msu.edu)
    or "msuphysics" (only if there is a good reason to limit to department
                     - we don't know of one)
    or "mydomain" (what is that?)
@@ -225,7 +417,9 @@ if ($hostname=~/([^\.]*)\.([^\.]*)$/) {
  cluster, you MUST contact the LON-CAPA group at MSU (loncapa\@loncapa.org)
  to have a domain name assigned, and then use it exactly as given. This is
  also true for test installs that might eventually turn into production setups.
- Stop now if you didn't do so.]
+ The short domain name needs to be unique, if your aim is to join a cluster 
+ containing existing domains. Stop now if you have not yet contacted the 
+ MSU LON-CAPA group.] 
 END
 
 # get domain name
@@ -280,7 +474,6 @@ END
   }
 }
 
-
 # get domain description
 # accept if valid, if not valid, tell user and repeat
 $flag=0;
@@ -382,8 +575,8 @@ This should be the LON-CAPA machine ID o
 domain.  If you only have a single library server in your domain, then
 the Primary Library server ID will be the machine ID of that server. 
 This server will be where domain data which are not associated with any
-specific home library server will be stored (e.g., e-mail broadcast by
-administrators to users in the domain).
+specific home library server will be stored (e.g., configurations that
+apply to all nodes in the domain).
 END
     if (defined($primaryLibServer)) {
         print(&lt;&lt;END);
@@ -430,7 +623,7 @@ my $lonAdmEMail;
 while (!$flag) {
   print(&lt;&lt;END);
 
-**** Server Administrators E-mail ****
+**** Server Administrator's E-mail ****
 E-mail address of the person who will manage this machine
 [should be in the form somebody\@somewhere]
 ENTER ADMIN E-MAIL ADDRESS:
@@ -524,7 +717,7 @@ while (!$flag) {
 
 The internet domain name used for servers at your institution 
 should be provided.  This will be similar to: ustate.edu or
-topcollege.ac.uk or my.hostingcompany.com, i.e., the part of
+topcollege.ac.uk or myhostingcompany.com, i.e., the part of
 a server hostname which indicates to which organization the 
 server belongs.
 
@@ -545,6 +738,330 @@ END
   }
 }
 
+# get hostname
+# accept if valid, if not valid, tell user and repeat
+$flag=0;
+my $posshostname;
+if (($hostname =~ /^[A-Za-z0-9\-]+$/) && ($intdom ne '')) {
+    $posshostname = $hostname.'.'.$intdom;
+} 
+if (($hostname =~ /^[A-Za-z0-9\-]+\.[A-Za-z0-9\-]+/) &&
+    ($hostname =~ /^[A-Za-z0-9.\-]+$/)) {
+    $posshostname = $hostname;
+}
+while (!$flag) {
+  print(&lt;&lt;END);
+
+****** Hostname of the server/VM *****
+
+The hostname of the server/VM is required. This will be similar to:
+somename.ustate.edu or somename.department.ustate.edu, and would be
+the web address which users would point their web browsers at to
+access the server.
+
+END
+
+if ($posshostname) {
+    print "ENTER HOSTNAME OF SERVER [$posshostname]:\n";
+} else {
+    print "ENTER HOSTNAME OF SERVER:\n";
+}
+
+  my $choice=&lt;&gt;;
+  chomp($choice);
+  if (($choice =~ /^[A-Za-z0-9\-]+\.[A-Za-z0-9\-]+/) &&
+      ($choice =~ /^[A-Za-z0-9.\-]+$/)) {
+    open(OUT,'&gt;&gt;/tmp/loncapa_updatequery.out');
+    print(OUT 'hostname'."\t".$choice."\n");
+    close(OUT);
+    $desiredhostname=$choice;
+    $flag=1;
+  } elsif (($choice eq '') && ($posshostname ne '')) {
+    open(OUT,'&gt;&gt;/tmp/loncapa_updatequery.out');
+    print(OUT 'hostname'."\t$posshostname\n");
+    close(OUT);
+    $desiredhostname = $posshostname;
+    $flag = 1;
+  } else {
+    print "Invalid input (only letters, numbers, - and . allowed, with at least one .).\n";
+  }
+}
+
+# get Country
+print(&lt;&lt;END);
+
+****** Information about Country, State or Province and City *****
+
+A two-letter country code, e.g., US, CA, DE etc. as defined by ISO 3166,
+is required. A state or province, and a city are also required.
+This locality information is included in two SSL certificates used internally
+by LON-CAPA, unless you are running standalone.
+
+If your server will be part of either the production or development 
+clusters, then the certificate will need to be signed by the official 
+LON-CAPA Certificate Authority (CA).  If you will be running your own 
+cluster then the cluster will need to create its own CA. 
+
+END
+
+my $posscountry;
+if ($desiredhostname =~ /\.(edu|com|org)$/) {
+    $posscountry = 'us';
+
+} else { 
+    ($posscountry) = ($desiredhostname =~ /\.(a-z){2}$/);
+}
+if ($posscountry) {
+    my $countrydesc = &Locale::Country::code2country($posscountry);
+    if ($countrydesc eq '') {
+        undef($posscountry);
+    }
+}
+
+$flag=0;
+while (!$flag) {
+  if ($posscountry) {
+     $posscountry = uc($posscountry);
+     print "ENTER TWO-LETTER COUNTRY CODE [$posscountry]:\n";
+  } else {
+     print "ENTER TWO-LETTER COUNTRY CODE:\n";
+  }
+  my $choice=&lt;&gt;;
+  chomp($choice);
+  if ($choice ne '') {
+    if (&Locale::Country::code2country(lc($choice))) {
+      open(OUT,'&gt;&gt;/tmp/loncapa_updatequery.out');
+      print(OUT 'country'."\t".uc($choice)."\n");
+      close(OUT);
+      $country=uc($choice);
+      $flag=1;
+    } else {
+      print "Invalid input -- a valid two letter country code is required\n";
+    }
+  } elsif (($choice eq '') && ($posscountry ne '')) {
+    open(OUT,'&gt;&gt;/tmp/loncapa_updatequery.out');
+    print(OUT 'country'."\t".$posscountry."\n");
+    close(OUT);
+    $country = $posscountry;
+    $flag = 1;
+  } else {
+    print "Invalid input -- a country code is required\n";
+  }
+}
+
+$flag=0;
+# get State or Province
+while (!$flag) {
+  print(&lt;&lt;END);
+
+ENTER STATE OR PROVINCE NAME:
+END
+
+  my $choice=&lt;&gt;;
+  chomp($choice);
+  if ($choice ne '') {
+    open(OUT,'&gt;&gt;/tmp/loncapa_updatequery.out');
+    print(OUT 'state'."\t".$choice."\n");
+    close(OUT);
+    $state=$choice;
+    $flag=1;
+  }
+  else {
+    print "Invalid input (a state or province name is required).\n";
+  }
+}
+
+$flag=0;
+# get City
+while (!$flag) {
+  print(&lt;&lt;END);
+
+ENTER CITY NAME:
+END
+
+  my $choice=&lt;&gt;;
+  chomp($choice);
+  if ($choice ne '') {
+    open(OUT,'&gt;&gt;/tmp/loncapa_updatequery.out');
+    print(OUT 'city'."\t".$choice."\n");
+    close(OUT);
+    $city=$choice;
+    $flag=1;
+  }
+  else {
+    print "Invalid input (a city is required).\n";
+  }
+}
+
+$flag=0;
+while (!$flag) {
+  print(&lt;&lt;END);
+
+The domain description, country, state and city will be
+used in the SSL certificates
+ 
+1) Domain Description: $domainDescription
+2) Country: $country
+3) State or Province: $state
+4) City: $city
+5) Everything is correct up above 
+
+ENTER A CHOICE OF 1-4 TO CHANGE, otherwise ENTER 5:
+END
+  my $choice=&lt;&gt;;
+  chomp($choice);
+  if ($choice == 1) {
+    print(&lt;&lt;END);
+1) Domain Description: $domainDescription
+ENTER NEW VALUE 
+END
+    my $choice2=&lt;&gt;;
+    chomp($choice2);
+    $domainDescription=$choice2;
+  }
+  elsif ($choice == 2) {
+    print(&lt;&lt;END);
+2) Country: $country
+ENTER NEW VALUE (this should be a two-character code, e,g, US, CA, DE)
+END
+    my $choice2=&lt;&gt;;
+    chomp($choice2);
+    $country = uc($choice2); 
+  }
+  elsif ($choice == 3) {
+    print(&lt;&lt;END);
+3) State or Province: $state
+ENTER NEW VALUE:
+END
+    my $choice2=&lt;&gt;;
+    chomp($choice2);
+    $state=$choice2;
+  }
+  elsif ($choice == 4) {
+    print(&lt;&lt;END);
+4) City: $city
+ENTER NEW VALUE:
+END
+    my $choice2=&lt;&gt;;
+    chomp($choice2);
+    $city=$choice2;
+  } elsif ($choice == 5) {
+    $flag=1;
+    $state =~ s{/}{ }g;
+    $city =~ s{/}{ }g;
+    $domainDescription =~ s{/}{ }g;
+  } else {
+    print "Invalid input.\n";
+  }
+}
+
+my $perlvarref = &get_static_config();
+if (ref($perlvarref) eq 'HASH') {
+  my ($certsdir,$privkey,$connectcsr,$replicatecsr);
+  $certsdir = $perlvarref->{'lonCertificateDirectory'};
+  $privkey = $perlvarref->{'lonnetPrivateKey'};  
+  $connectcsr = $perlvarref->{'lonnetCertificate'};
+  $connectcsr =~ s/\.pem$/.csr/;
+  $replicatecsr = $perlvarref->{'lonnetHostnameCertificate'};
+  $replicatecsr =~ s/\.pem$/.csr/;
+
+  print(&lt;&lt;END);
+
+****** SSL Certificates *****
+
+You need to provide a password to be used for the openssl key which
+will be stored in $certsdir, and will be used when creating two
+certificate signing requests: $connectcsr and $replicatecsr
+
+END
+
+  my $sslkeypass;
+  $flag=0;
+# get Password for SSL key
+  while (!$flag) {
+    $sslkeypass = &make_passphrase();
+    if ($sslkeypass) {
+      $flag = 1;
+    } else {
+      print "Invalid input (a password is required for the SSL key).\n";
+    }
+  }
+
+  if ($certsdir && $privkey) {
+    my $connectsubj = "/C=$country/ST=$state/O=$domainDescription/L=$city/CN=$lonHostID/OU=LONCAPA/emailAddress=$lonAdmEMail";
+    my $replicatesubj = "/C=$country/ST=$state/O=$domainDescription/L=$city/CN=internal-$desiredhostname/OU=LONCAPA/emailAddress=$lonAdmEMail";
+
+# generate SSL key
+# generate SSL csr for hostID
+# generate SSL csr for internal hostname
+
+    if (-f "$certsdir/lonKey.enc") {
+        my $mode = 0600;
+        chmod $mode, "$certsdir/lonKey.enc";
+    }
+    open(PIPE,"openssl genrsa -des3 -passout pass:$sslkeypass -out $certsdir/lonKey.enc 2048 2&gt;&1 |");
+    close(PIPE);
+    if (-f "$certsdir/$privkey") {
+        my $mode = 0600;
+        chmod $mode, "$certsdir/$privkey";
+    }
+    open(PIPE,"openssl rsa -in $certsdir/lonKey.enc -passin pass:$sslkeypass -out $certsdir/$privkey -outform PEM |");
+    close(PIPE);
+    if ($connectcsr) {
+        open(PIPE,"openssl req -key $certsdir/lonKey.enc -passin pass:$sslkeypass -new -batch -subj \"$connectsubj\" -out $certsdir/$connectcsr |");
+        close(PIPE);
+    }
+    if ($replicatecsr) { 
+        open(PIPE,"openssl req -key $certsdir/lonKey.enc -passin pass:$sslkeypass -new -batch -subj \"$replicatesubj\" -out $certsdir/$replicatecsr |");
+        close(PIPE);
+    }
+    if (-f "$certsdir/lonKey.enc") {
+        my $mode = 0400;
+        chmod $mode, "$certsdir/lonKey.enc";
+    }
+    if (-f "$certsdir/$privkey") {
+        my $mode = 0400;
+        chmod $mode, "$certsdir/$privkey";
+    }
+  }
+
+  my $camail;
+  if ($lonCluster eq 'production' || $lonCluster eq 'development') {
+    $camail = $perlvarref->{'SSLEmail'};
+  } else {
+    $flag=0;
+# get Certificate Authority E-mail 
+    while (!$flag) {
+      print(&lt;&lt;END);
+
+ENTER EMAIL ADDRESS TO SEND CERTIFICATE SIGNING REQUESTS
+END
+
+      my $choice=&lt;&gt;;
+      chomp($choice);
+      if ($choice ne '') {
+        open(OUT,'&gt;&gt;/tmp/loncapa_updatequery.out');
+        print(OUT 'Certificate Authority Email Address'."\t".$choice."\n");
+        close(OUT);
+        $camail=$choice;
+        $flag=1;
+      } else {
+        print "Invalid input (an email address is required).\n";
+      }
+    }
+  }
+  if ($camail) {
+    my $subj;
+    if (-e "$certsdir/$connectcsr") { 
+        $subj = "Certificate Request ($lonHostID)";
+        print(&send_mail($desiredhostname,$camail,$subj,"$certsdir/$connectcsr"));
+    }
+    if (-e "$certsdir/$replicatecsr") {
+        $subj = "Certificate Request (internal-$desiredhostname)";
+        print(&send_mail($desiredhostname,$camail,$subj,"$certsdir/$replicatecsr"));
+    }
+  }
+}
 
 # update loncapa.conf
 my $confdir = '/etc/httpd/conf/';
@@ -690,6 +1207,7 @@ my %perlvarstatic;
     push(@hosts_files,'/home/httpd/lonTabs/hosts.tab',
          '/home/httpd/lonTabs/dns_hosts.tab');
 
+    my @poss_hosts_files = @hosts_files;
     if (!$domainDescription) {
 	foreach my $file (@domain_files) {
 	    open(IN,'&lt;'.$file);
@@ -708,13 +1226,18 @@ my %perlvarstatic;
 	}
     }
 
-    if (!$protocol) {
+    if ((!$protocol) || (!$desiredhostname)) {
         foreach my $file (@hosts_files) {
             open(IN,'&lt;'.$file);
             while(my $line = &lt;IN&gt;) {
-                if ($line =~ /^\Q$perlvar{'lonHostID'}\E:\Q$perlvar{'lonDefDomain'}\E\:(?:access|library)\:[^:]+\:(https?)/) {
-                    $protocol = $1;
-                    chomp($protocol);
+                if ($line =~ /^\Q$perlvar{'lonHostID'}\E:\Q$perlvar{'lonDefDomain'}\E\:(?:access|library)\:([^:]+)\:(https?)/) {
+                    if (!$desiredhostname) {
+                        $desiredhostname = $1;
+                    }
+                    if (!$protocol) { 
+                        $protocol = $2;
+                        chomp($protocol);
+                    }
                     last;
                 }
             }
@@ -738,6 +1261,7 @@ my %perlvarstatic;
         }
     }
 
+    my (%hostnames,%protocols);
     while(!$primaryLibServer && (@hosts_files || @domain_files)) {
 	my $file = shift(@domain_files);
         open(IN,'&lt;'.$file);
@@ -752,8 +1276,9 @@ my %perlvarstatic;
 	$file = shift(@hosts_files);
 	open(IN,'&lt;'.$file);
 	while(my $line = &lt;IN&gt;) {
-	    if ($line =~ /^([^\:]+)\:\Q$perlvar{'lonDefDomain'}\E\:library\:/) {
+	    if ($line =~ /^([^\:]+)\:\Q$perlvar{'lonDefDomain'}\E\:library\:([^\:]+)/) {
 		push(@libservers,$1);
+                $hostnames{$1} = $2;
 	    }
 	}
 	# make list unique
@@ -763,12 +1288,204 @@ my %perlvarstatic;
 	    $primaryLibServer = $libservers[0];
 	}
     }
+
+# get hostname of primaryLibServer
+    my ($primary_hostname,$primary_protocol);
+    if ($primaryLibServer) {
+        if ($hostnames{$primaryLibServer}) {
+            $primary_hostname = $hostnames{$primaryLibServer};
+            $primary_protocol = $protocols{$primaryLibServer};
+        } else {
+            foreach my $file (@poss_hosts_files) {
+                open(IN,'&lt;'.$file);
+                while (my $line = &lt;IN&gt;) {
+                    if ($line =~ /^([^\:]+)\:\Q$perlvar{'lonDefDomain'}\E\:library\:([^\:]+):(https?)/) {
+                        if ($1 eq $primaryLibServer) {
+                            $primary_hostname = $2;
+                            $primary_protocol = $3;
+                            last;
+                        }
+                    }
+                }
+                close(IN);
+                last if ($primary_hostname);
+            }
+        }
+    }
    
 # implement editing logic below, interactively
-# update loncapa.conf until 14 is entered
+# update loncapa.conf until 17 is entered
 
 my $flag=0;
 
+#
+# Changes to 5, 6, and 14 not supported if configuration.db set on primary library server.
+# (requires either this machine to be primary library server or for LON-CAPA and Apache
+# to be running on primary library server.
+#
+
+my ($isprimary,$domconf,$url,$gotdomconf,$adminmail,$supportmail,$connectssl,%setbygui);
+if ($primaryLibServer eq $perlvar{'lonHostID'}) {
+    $isprimary = 1;
+} else {
+    unless ($primary_protocol eq 'https') {
+        $primary_protocol = 'http';
+    } 
+    $url = $primary_protocol.'://'.$primary_hostname.'/cgi-bin/listdomconfig.pl';
+}
+my $domconf = &get_domain_config($perlvar{'lonDefDomain'},$isprimary,$url,\%perlvarstatic);
+if (ref($domconf)) {
+    $gotdomconf = 1;
+    if (ref($domconf->{'contacts'}) eq 'HASH') {
+        if (exists($domconf->{'contacts'}->{'adminemail'})) {
+            $adminmail = $domconf->{'contacts'}->{'adminemail'};
+        }
+        if (exists($domconf->{'contacts'}->{'supportemail'})) {
+            $supportmail = $domconf->{'contacts'}->{'supportemail'};
+        }
+    }
+    if (ref($domconf->{'ssl'}) eq 'HASH') {
+        if (ref($domconf->{'ssl'}->{'connect'}) eq 'HASH') {       
+            my ($sslreq,$sslnoreq);
+            my %contypes; 
+            foreach my $type ('dom','intdom','other') {
+                my $key;
+                if ($domconf->{'ssl'}->{'connect'}->{$type} eq 'req') {
+                    $key = 'yes';
+                } else {
+                    $key = 'no';
+                }
+                if ($type eq 'dom') {
+                    $contypes{$key} .= ' own domain,';
+                } elsif ($type eq 'intdom') {
+                    $contypes{$key} .= ' own institution,';
+                } elsif ($type eq 'other') { 
+                    $contypes{$key} .= ' other domains,';
+                }
+            }
+            foreach my $key (sort(keys(%contypes))) {
+                $contypes{$key} =~ s/^\s//;
+                $contypes{$key} =~ s/,$//;
+                if ($key eq 'yes') {
+                    $connectssl .= ' Yes ('.$contypes{$key}.'),';
+                } elsif ($key eq 'no') {
+                    $connectssl = ' No ('.$contypes{$key}.')';
+                }
+                $connectssl =~ s/,$//;
+            }
+        }
+    }
+}
+if ($connectssl) {
+    $setbygui{'securestatus'} = 1;
+    $securestatus = 'Set by domain configuration via web GUI. Currently: '.$connectssl; 
+}
+if ($adminmail) {
+    $adminmail = 'Set by domain configuration via web GUI. Currently: '.$adminmail;
+    $setbygui{'lonAdmEMail'} = 1;
+} else {
+    $adminmail = $perlvar{'lonAdmEMail'};
+}
+if ($supportmail) {
+    $supportmail = 'Set by domain configuration via web GUI. Currently: '.$supportmail;
+    $setbygui{'lonSupportEMail'} = 1;
+} else {
+    $supportmail = $perlvar{'lonSupportEMail'};
+}
+
+print "\nRetrieving status information for SSL key and certificates ...\n\n";
+my ($lonhostcertstatus,$lonhostnamecertstatus,$lonkeystatus);
+my $currcerts = &LONCAPA::SSL::print_certstatus({$perlvar{'lonHostID'} => 1,},'text','cgi');
+chomp($currcerts);
+my %sslstatus;
+
+if ($currcerts eq "$perlvar{'lonHostID'}:error") {
+    print "No information available for SSL certificates\n";
+    $sslstatus{'key'} = -1;
+    $sslstatus{'host'} = -1;
+    $sslstatus{'hostname'} = -1;
+    $sslstatus{'ca'} = -1;
+    $lonkeystatus = 'unknown status';
+    $lonhostcertstatus = 'unknown status';
+    $lonhostnamecertstatus = 'unknown status';
+} else {
+    my %sslnames = (
+                      key      => 'lonnetPrivateKey',
+                      host     => 'lonnetCertificate',
+                      hostname => 'lonnetHostnameCertificate',
+                      ca       => 'lonnetCertificateAuthority',
+                   );
+    my %ssldesc = (
+                    key      => 'Private Key',
+                    host     => 'Connections Certificate',
+                    hostname => 'Replication Certificate',
+                    ca       => 'LON-CAPA CA Certificate',
+                  );
+    my ($lonhost,$info) = split(/\:/,$currcerts,2);
+    if ($lonhost eq $perlvar{'lonHostID'}) {
+        my @items = split(/\&/,$info);
+        foreach my $item (@items) {
+            my ($key,$value) = split(/=/,$item,2);
+            my @data = split(/,/,$value);
+            if (grep(/^\Q$key\E$/,keys(%sslnames))) {
+                if (lc($data[0]) eq 'yes') { 
+                    print "$ssldesc{$key} $perlvarstatic{$sslnames{$key}} available with status = $data[1]\n";
+                    if ($key eq 'key') {
+                        $lonkeystatus = "status: $data[1]"; 
+                        if ($data[1] =~ /ok$/) {
+                            $sslstatus{$key} = 1;
+                        } 
+                    } else {
+                        if ($data[1] eq 'Expired') {
+                            $sslstatus{$key} = 2;
+                        } else {
+                            $sslstatus{$key} = 1;
+                        }
+                        if ($key eq 'host') {
+                            $lonhostcertstatus = "status: $data[1]";
+                        } elsif ($key eq 'hostname') {
+                            $lonhostnamecertstatus = "status: $data[1]";
+                        }
+                    }
+                } else {
+                    $sslstatus{$key} = 0;
+                    print "$ssldesc{$key} $perlvarstatic{$sslnames{$key}} not available\n";
+                    if (($key eq 'host') || ($key eq 'hostname')) {
+                        my $csr = $perlvarstatic{$sslnames{$key}};
+                        $csr =~s /\.pem$/.csr/;
+                        my $csrstatus;
+                        if (-e "$perlvarstatic{'lonCertificateDirectory'}/$csr") {
+                            open(PIPE,"openssl req -text -noout -verify -in $perlvarstatic{'lonCertificateDirectory'}/$csr 2&gt;&1 |");
+                            while(&lt;PIPE&gt;) {
+                                chomp();
+                                $csrstatus = $_;
+                                last;
+                            }
+                            close(PIPE);
+                            print "Certificate signing request for $ssldesc{$key} available with status = $csrstatus\n\n";
+                            if ($key eq 'host') {
+                                $lonhostcertstatus = 'awaiting signature';
+                            } else {
+                                $lonhostnamecertstatus = 'awaiting signature';
+                            }
+                            $sslstatus{$key} = 3;
+                        } else {
+                            print "No certificate signing request available for $ssldesc{$key}\n\n";
+                            if ($key eq 'host') {
+                                $lonhostcertstatus = 'still needed';
+                            } else {
+                                $lonhostnamecertstatus = 'still needed';
+                            }
+                        }
+                    } elsif ($key eq 'key') {
+                        $lonkeystatus = 'still needed';
+                    }
+                }
+            }
+        }
+    }
+}
+
 while (!$flag) {
   print(&lt;&lt;END);
 
@@ -778,16 +1495,20 @@ This is now the current configuration of
  2) Domain Description: $domainDescription
  3) Machine Name: $perlvar{'lonHostID'}
  4) ID of primary library server for domain: $primaryLibServer
- 5) Server Administrator's E-mail Address: $perlvar{'lonAdmEMail'}
- 6) Support E-mail Address: $perlvar{'lonSupportEMail'}
+ 5) Server Administrator's E-mail Address: $adminmail
+ 6) Support E-mail Address: $supportmail
  7) Web Server Protocol (http or https): $protocol 
  8) Internet Domain Name: $intdom 
- 9) Role: $perlvar{'lonRole'}
-10) Cache Expiration Time: $perlvar{'lonExpire'}
-11) Server Load: $perlvar{'lonLoadLim'}
-12) User Load: $perlvar{'lonUserLoadLim'}
-13) Allow only secure connections: $securestatus 
-14) Everything is correct up above
+ 9) Hostname: $desiredhostname
+10) Role: $perlvar{'lonRole'}
+11) Cache Expiration Time: $perlvar{'lonExpire'} (seconds)
+12) Server Load: $perlvar{'lonLoadLim'}
+13) User Load: $perlvar{'lonUserLoadLim'}
+14) Allow only secure connections: $securestatus
+15) Private Key for SSL: $lonkeystatus
+16) SSL Certificate for LON-CAPA server connections: $lonhostcertstatus
+17) SSL Certificate for Content Replication: $lonhostnamecertstatus
+18) Everything is correct up above
 END
 
 my @error;
@@ -851,9 +1572,17 @@ if (!defined($primaryLibServer)) {
 }
 
 
+my ($certsdir,$privkey,$connectcsr,$replicatecsr);
+$certsdir = $perlvarstatic{'lonCertificateDirectory'};
+$privkey = $perlvarstatic{'lonnetPrivateKey'};
+$connectcsr = $perlvarstatic{'lonnetCertificate'};
+$connectcsr =~ s/\.pem$/.csr/;
+$replicatecsr = $perlvarstatic{'lonnetHostnameCertificate'};
+$replicatecsr =~ s/\.pem$/.csr/;
+
 if (@error) { print "\n*** ERRORS: \n\t".join("\n\t",@error)."\n"; }
   print(&lt;&lt;END);
-ENTER A CHOICE OF 1-13 TO CHANGE, otherwise ENTER 14:
+ENTER A CHOICE OF 1-17 TO CHANGE, otherwise ENTER 18:
 END
 my $choice=&lt;&gt;;
 chomp($choice);
@@ -906,22 +1635,36 @@ END
     $primaryLibServer=$choice2;
   }
   elsif ($choice==5) {
-  print(&lt;&lt;END);
+    if ($setbygui{'lonAdmEMail'}) {
+      print(&lt;&lt;END);
+5) Server Administrator's E-mail Address: $adminmail
+Use the web GUI (as domain coordinator) to make changes after completing the UPDATE.
+END
+    } else {
+      print(&lt;&lt;END);
 5) Server Administrator's E-mail Address: $perlvar{'lonAdmEMail'}
 ENTER NEW VALUE:
 END
-    my $choice2=&lt;&gt;;
-    chomp($choice2);
-    $perlvar{'lonAdmEMail'}=$choice2;
+      my $choice2=&lt;&gt;;
+      chomp($choice2);
+      $perlvar{'lonAdmEMail'}=$choice2;
+    }
   }
   elsif ($choice==6) {
-  print(&lt;&lt;END);
+    if ($setbygui{'lonAdmEMail'}) {
+      print(&lt;&lt;END);
+6) Support E-mail Address: $supportmail
+Use the web GUI (as domain coordinator) to make changes after completing the UPDATE.
+END
+    } else {    
+      print(&lt;&lt;END);
 6) Support E-mail Address: $perlvar{'lonSupportEMail'}
 ENTER NEW VALUE:
 END
-    my $choice2=&lt;&gt;;
-    chomp($choice2);
-    $perlvar{'lonSupportEMail'}=$choice2;
+      my $choice2=&lt;&gt;;
+      chomp($choice2);
+      $perlvar{'lonSupportEMail'}=$choice2;
+    }
   }
   elsif ($choice==7) {
   print(&lt;&lt;END);
@@ -945,7 +1688,18 @@ END
   }
   elsif ($choice==9) {
   print(&lt;&lt;END);
-9) Role: $perlvar{'lonRole'}
+9) Hostname of Server/VM
+ENTER NEW VALUE:
+
+END
+    my $choice2=&lt;&gt;;
+    chomp($choice2);
+    $desiredhostname=$choice2;
+  }
+
+  elsif ($choice==10) {
+  print(&lt;&lt;END);
+10) Role: $perlvar{'lonRole'}
 ENTER NEW VALUE (this should be either 'access' or 'library' 
                  if in doubt select 'library'):
 END
@@ -953,27 +1707,27 @@ END
     chomp($choice2);
     $perlvar{'lonRole'}=$choice2;
   }
-  elsif ($choice==10) {
+  elsif ($choice==11) {
   print(&lt;&lt;END);
-10) Cache Expiration Time: $perlvar{'lonExpire'}
+11) Cache Expiration Time: $perlvar{'lonExpire'}
 ENTER NEW VALUE (in seconds, 86400 is a reasonable value):
 END
     my $choice2=&lt;&gt;;
     chomp($choice2);
     $perlvar{'lonExpire'}=$choice2;
   }
-  elsif ($choice==11) {
+  elsif ($choice==12) {
   print(&lt;&lt;END);
-11) Server Load: $perlvar{'lonLoadLim'}
+12) Server Load: $perlvar{'lonLoadLim'}
 ENTER NEW VALUE:
 END
     my $choice2=&lt;&gt;;
     chomp($choice2);
     $perlvar{'lonLoadLim'}=$choice2;
   }
-  elsif ($choice==12) {
+  elsif ($choice==13) {
   print(&lt;&lt;END);
-12) User Load: $perlvar{'lonUserLoadLim'}
+13) User Load: $perlvar{'lonUserLoadLim'}
 Numer of users that can login before machine is 'overloaded'
 ENTER NEW VALUE (integer value, 0 means there is no limit):
 END
@@ -981,9 +1735,15 @@ END
     chomp($choice2);
     $perlvar{'lonUserLoadLim'}=$choice2;
   }
-  elsif ($choice==13) {
-  print(&lt;&lt;END);
-13) Allow only secure connections: $securestatus 
+  elsif ($choice==14) {
+    if ($setbygui{'securestatus'}) {
+      print(&lt;&lt;END);
+14) Allow only secure connections: $securestatus
+Use the web GUI (as domain coordinator) to make changes after completing the UPDATE.
+END
+    } else {
+      print(&lt;&lt;END);
+14) Allow only secure connections: $securestatus 
 The Lon-CAPA communication daemons lonc and lond can be configured to
 allow only secure connections by default.
 
@@ -995,28 +1755,69 @@ POSSIBLE CHOICES:
 3) allow insecure connections to this machine but only allow connections
     to machines that support secure connections
 4) allow insecure connections
-ENTER NEW VALUE (currenly $securenum):
+ENTER NEW VALUE (currently $securenum):
 END
-    my $choice2=&lt;&gt;;
-    chomp($choice2);
-    if      ($choice2 eq '1') {
-	$perlvar{'loncAllowInsecure'}=0;$perlvar{'londAllowInsecure'}=0;
-    } elsif ($choice2 eq '2') {
-	$perlvar{'loncAllowInsecure'}=0;$perlvar{'londAllowInsecure'}=1;
-    } elsif ($choice2 eq '3') {
-	$perlvar{'loncAllowInsecure'}=1;$perlvar{'londAllowInsecure'}=0;
-    } elsif ($choice2 eq '4') {
-	$perlvar{'loncAllowInsecure'}=1;$perlvar{'londAllowInsecure'}=1;
+      my $choice2=&lt;&gt;;
+      chomp($choice2);
+      if      ($choice2 eq '1') {
+	  $perlvar{'loncAllowInsecure'}=0;$perlvar{'londAllowInsecure'}=0;
+      } elsif ($choice2 eq '2') {
+	  $perlvar{'loncAllowInsecure'}=0;$perlvar{'londAllowInsecure'}=1;
+      } elsif ($choice2 eq '3') {
+	  $perlvar{'loncAllowInsecure'}=1;$perlvar{'londAllowInsecure'}=0;
+      } elsif ($choice2 eq '4') {
+	  $perlvar{'loncAllowInsecure'}=1;$perlvar{'londAllowInsecure'}=1;
+      }
+      ($securestatus,$securenum)=&securesetting(%perlvar);
     }
-    ($securestatus,$securenum)=&securesetting(%perlvar);
-  }
-  elsif (($choice==14) && (!@error)) {
+  } elsif ($choice==15) {
+      #$sslstatus{'key'};
+      print(&lt;&lt;END);
+15) Private Key for SSL: $lonkeystatus
+
+POSSIBLE CHOICES:
+1) overwrite existing key
+2) create new key for use later
+3) make no change
+ENTER NEW VALUE
+END
+      my $choice2=&lt;&gt;;
+      chomp($choice2);
+  } elsif ($choice==16) {
+      #$sslstatus{'host'};
+      print(&lt;&lt;END);
+16) SSL Certificate for LON-CAPA server connections: $lonhostcertstatus
+
+POSSIBLE CHOICES:
+1) create new certificate signing request with new key
+2) create new certificate signing request with existing key
+3) resend current certificate signing request
+4) make no change
+ENTER NEW VALUE
+END
+      my $choice2=&lt;&gt;;
+      chomp($choice2);
+  } elsif ($choice==17) {
+      #$sslstatus{'hostname'}
+      print(&lt;&lt;END);
+17) SSL Certificate for Content Replication: $lonhostnamecertstatus
+
+POSSIBLE CHOICES:
+1) create new certificate signing request with new key
+2) create new certificate signing request with existing key
+3) resend current certificate signing request
+4) make no change
+ENTER NEW VALUE
+END
+      my $choice2=&lt;&gt;;
+      chomp($choice2);
+  } elsif (($choice==18) && (!@error)) {
     $flag=1;
-  }
-  else {
+  } else {
     print "Invalid input.\n";
   }
 }
+
     open(OUT,"&gt;$confdir$filename") or
       die("Cannot output to $confdir$filename\n");
     foreach my $key (keys %perlvar) {
@@ -1036,14 +1837,17 @@ END
 <target dist='default'>loncom/hosts.tab</target>
 <perlscript mode='fg'>
 unless (-l "<TARGET />") {
-  my $hostname=`hostname -f`;chomp($hostname);
+  if ($desiredhostname eq '') { 
+      my $hostname=`hostname -f`;chomp($hostname);
+      $desiredhostname = $hostname;
+  }
   my $date=`date -I`; chomp($date);
   my $lonHostID=$perlvar{'lonHostID'};
   $lonHostID=~s/[^\w\-.]//g;
   my $lineexistflag=0;
   my $hostidexistflag=0;
   my $line2insert=&lt;&lt;END;
-$perlvar{'lonHostID'}:$perlvar{'lonDefDomain'}:$perlvar{'lonRole'}:$hostname:$protocol:$intdom
+$perlvar{'lonHostID'}:$perlvar{'lonDefDomain'}:$perlvar{'lonRole'}:$desiredhostname:$protocol:$intdom
 END
   if (!$domainTabExtras) {
 	$domainTabExtras=':::::';
@@ -1053,7 +1857,7 @@ END
     open(OUT,'&gt;../'.$lonCluster.'_hosts.tab') or
       die('file generation error');
       print(OUT $line2insert);
-      print OUT ("^$hostname:$protocol\n");
+      print OUT ("^$desiredhostname:$protocol\n");
     close(OUT);
     open(OUT,'&gt;../'.$lonCluster.'_dns_hosts.tab') or
       die('file generation error');