--- doc/loncapafiles/updatequery.piml	2018/06/19 12:26:32	1.89
+++ doc/loncapafiles/updatequery.piml	2020/01/04 18:03:16	1.93
@@ -1,6 +1,6 @@
 <!-- updatequery.piml -->
 
-<!-- $Id: updatequery.piml,v 1.89 2018/06/19 12:26:32 raeburn Exp $ -->
+<!-- $Id: updatequery.piml,v 1.93 2020/01/04 18:03:16 raeburn Exp $ -->
 
 <!--
 
@@ -62,7 +62,7 @@ sub get_new_sslkeypass {
 sub get_static_config {
 # get LCperlvars from loncapa_apache.conf
     my $confdir = '/etc/httpd/conf/';
-    if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16' || '<DIST />' eq 'ubuntu18') {
+    if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'sles15' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16' || '<DIST />' eq 'ubuntu18' || '<DIST />' eq 'ubuntu20') {
         $confdir = '/etc/apache2/';
     }
     my $filename='loncapa_apache.conf';
@@ -537,8 +537,8 @@ sub get_ssldesc {
 }
 
 sub get_cert_status {
-    my ($lonHostID,$perlvarstatic) = @_;
-    my $currcerts = &LONCAPA::SSL::print_certstatus({$lonHostID =&gt; 1,},'text','cgi');
+    my ($lonHostID,$hostname,$perlvarstatic) = @_;
+    my $currcerts = &LONCAPA::SSL::print_certstatus({$lonHostID =&gt; $hostname,},'text','install');
     my ($lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,%sslstatus);
     my $output = '';
     if ($currcerts eq "$lonHostID:error") {
@@ -553,13 +553,18 @@ sub get_cert_status {
     } else {
         my %sslnames = &get_sslnames();
         my %ssldesc = &get_ssldesc();
+        my %csr;
         my ($lonhost,$info) = split(/\:/,$currcerts,2);
         if ($lonhost eq $lonHostID) {
             my @items = split(/\&/,$info);
             foreach my $item (@items) {
                 my ($key,$value) = split(/=/,$item,2);
+                if ($key =~ /^(host(?:|name))\-csr$/) {
+                    $csr{$1} = $value;
+                }
                 my @data = split(/,/,$value);
                 if (grep(/^\Q$key\E$/,keys(%sslnames))) {
+                    my ($checkcsr,$comparecsr);
                     if (lc($data[0]) eq 'yes') {
                         $output .= "$ssldesc{$key} ".$perlvarstatic-&gt;{$sslnames{$key}}." available with status = $data[1]\n";
                         if ($key eq 'key') {
@@ -587,6 +592,9 @@ sub get_cert_status {
                                         $lonhostnamecertstatus = "status: created with missing key";
                                     }
                                 }
+                                if ($setstatus) {
+                                    $comparecsr = 1;
+                                }
                             }
                             unless ($setstatus) {
                                 if ($data[1] eq 'expired') {
@@ -606,18 +614,25 @@ sub get_cert_status {
                     } else {
                         $sslstatus{$key} = 0;
                         $output .= "$ssldesc{$key} ".$perlvarstatic-&gt;{$sslnames{$key}}." not available\n";
-                        if (($key eq 'host') || ($key eq 'hostname')) {
-                            my $csr = $perlvarstatic-&gt;{$sslnames{$key}};
-                            $csr =~s /\.pem$/.csr/;
-                            my $csrstatus;
-                            if (-e $perlvarstatic-&gt;{'lonCertificateDirectory'}."/$csr") {
-                                open(PIPE,"openssl req -text -noout -verify -in ".$perlvarstatic-&gt;{'lonCertificateDirectory'}."/$csr 2&gt;&1 |");
-                                while(&lt;PIPE&gt;) {
-                                    chomp();
-                                    $csrstatus = $_;
-                                    last;
-                                }
-                                close(PIPE);
+                        if ($key eq 'key') {
+                            $lonkeystatus = 'still needed';
+                        } elsif (($key eq 'host') || ($key eq 'hostname')) {
+                            $checkcsr = 1;
+                        }
+                    }
+                    if (($checkcsr) || ($comparecsr)) {
+                        my $csrfile = $perlvarstatic-&gt;{$sslnames{$key}};
+                        $csrfile =~s /\.pem$/.csr/;
+                        my $csrstatus;
+                        if (-e $perlvarstatic-&gt;{'lonCertificateDirectory'}."/$csrfile") {
+                            open(PIPE,"openssl req -text -noout -verify -in ".$perlvarstatic-&gt;{'lonCertificateDirectory'}."/$csrfile 2&gt;&1 |");
+                            while(&lt;PIPE&gt;) {
+                                chomp();
+                                $csrstatus = $_;
+                                last;
+                            }
+                            close(PIPE);
+                            if ((($comparecsr) && ($csr{$key})) || ($checkcsr)) {
                                 $output .= "Certificate signing request for $ssldesc{$key} available with status = $csrstatus\n\n";
                                 if ($key eq 'host') {
                                     $lonhostcertstatus = 'awaiting signature';
@@ -625,16 +640,14 @@ sub get_cert_status {
                                     $lonhostnamecertstatus = 'awaiting signature';
                                 }
                                 $sslstatus{$key} = 3;
+                            }
+                        } elsif ($checkcsr) {
+                            $output .= "No certificate signing request available for $ssldesc{$key}\n\n";
+                            if ($key eq 'host') {
+                                $lonhostcertstatus = 'still needed';
                             } else {
-                                $output .= "No certificate signing request available for $ssldesc{$key}\n\n";
-                                if ($key eq 'host') {
-                                    $lonhostcertstatus = 'still needed';
-                                } else {
-                                    $lonhostnamecertstatus = 'still needed';
-                                }
+                                $lonhostnamecertstatus = 'still needed';
                             }
-                        } elsif ($key eq 'key') {
-                            $lonkeystatus = 'still needed';
                         }
                     }
                 }
@@ -1288,7 +1301,7 @@ END
 
 # update loncapa.conf
 my $confdir = '/etc/httpd/conf/';
-if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16' || '<DIST />' eq 'ubuntu18') {
+if ('<DIST />' eq 'sles10' || '<DIST />' eq 'sles11' || '<DIST />' eq 'sles12' || '<DIST />' eq 'sles15' || '<DIST />' eq 'suse10.1' || '<DIST />' eq 'suse10.2' || '<DIST />' eq 'suse10.3' || '<DIST />' eq 'suse11.1' || '<DIST />' eq 'suse11.2' || '<DIST />' eq 'suse11.3' || '<DIST />' eq 'suse11.4' || '<DIST />' eq 'suse12.1' || '<DIST />' eq 'suse12.2' || '<DIST />' eq 'suse12.3' || '<DIST />' eq 'suse13.1' || '<DIST />' eq 'suse13.2' || '<DIST />' eq 'debian5' || '<DIST />' eq 'debian6' || '<DIST />' eq 'ubuntu6' || '<DIST />' eq 'ubuntu8' || '<DIST />' eq 'ubuntu10' || '<DIST />' eq 'ubuntu12' || '<DIST />' eq 'ubuntu14' || '<DIST />' eq 'ubuntu16' || '<DIST />' eq 'ubuntu18' || '<DIST />' eq 'ubuntu20') {
      $confdir = '/etc/apache2/';
 }   
 my $filename='loncapa.conf';
@@ -1345,7 +1358,7 @@ END
 </file>
 <file>
 <target dist='default'>/etc/httpd/conf/</target>
-<target dist='sles10 sles11 sles12 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2 debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12 ubuntu14 ubuntu16 ubuntu18'>/etc/apache2/</target>
+<target dist='sles10 sles11 sles12 sles15 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2 debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12 ubuntu14 ubuntu16 ubuntu18 ubuntu20'>/etc/apache2/</target>
 <perlscript mode='fg'>
 # read values from loncapa.conf
 my $confdir = "<TARGET />";
@@ -1601,7 +1614,7 @@ if ($supportmail) {
 
 print "\nRetrieving status information for SSL key and certificates ...\n\n";
 my ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) = 
-    &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+    &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
 print $certinfo;
 my %sslstatus;
 if (ref($sslref) eq 'HASH') {
@@ -1918,7 +1931,7 @@ END
           &make_key($certsdir,$privkey,$sslkeypass);
           print "\nRetrieving status information for SSL key and certificates ...\n\n";
           ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-             &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+             &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
           if (ref($sslref) eq 'HASH') {
               %sslstatus = %{$sslref};
           }
@@ -1957,7 +1970,7 @@ END
               &mail_csr('host',$lonCluster,$perlvar{'lonHostID'},$desiredhostname,$certsdir,$connectcsr,$replicatecsr,$perlvarstatic);
               print "\nRetrieving status information for SSL key and certificates ...\n\n";
               ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-                  &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+                  &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
               if (ref($sslref) eq 'HASH') {
                   %sslstatus = %{$sslref};
               }
@@ -2002,7 +2015,7 @@ END
           &mail_csr('host',$lonCluster,$perlvar{'lonHostID'},$desiredhostname,$certsdir,$connectcsr,$replicatecsr,$perlvarstatic);
           print "\nRetrieving status information for SSL key and certificates ...\n\n";
           ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-              &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+              &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
           if (ref($sslref) eq 'HASH') {
               %sslstatus = %{$sslref};
           }
@@ -2039,7 +2052,7 @@ END
               &mail_csr('hostname',$lonCluster,$perlvar{'lonHostID'},$desiredhostname,$certsdir,$connectcsr,$replicatecsr,$perlvarstatic);
               print "\nRetrieving status information for SSL key and certificates ...\n\n";
               ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-                  &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+                  &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
               if (ref($sslref) eq 'HASH') {
                   %sslstatus = %{$sslref};
               }
@@ -2084,7 +2097,7 @@ END
           &mail_csr('hostname',$lonCluster,$perlvar{'lonHostID'},$desiredhostname,$certsdir,$connectcsr,$replicatecsr,$perlvarstatic);
           print "\nRetrieving status information for SSL key and certificates ...\n\n";
           ($certinfo,$lonkeystatus,$lonhostcertstatus,$lonhostnamecertstatus,$sslref) =
-              &get_cert_status($perlvar{'lonHostID'},$perlvarstatic);
+              &get_cert_status($perlvar{'lonHostID'},$desiredhostname,$perlvarstatic);
           if (ref($sslref) eq 'HASH') {
               %sslstatus = %{$sslref};
           }