Apache (Linux)

If the certificate being pushed was enrolled with CSR generation at endpoint, this field is auto populated with the category selected at the time of certificate enrollment.

If the certificate being pushed was enrolled with CSR generation at endpoint, this field is auto populated with the vendor selected at the time of certificate enrollment.

In the Key Location field, enter the path to the location on your local system where the private key file for the certificate to be pushed is stored.

• None: No service action is performed after certificate deployment.
• Reload: Reloads the Apache service to apply the updated certificate without interrupting existing connections.
• Restart: Restarts the Apache service after certificate deployment.

Apache Reload and Restart Command Execution

{
  "apache_linux_reload_restart_commands": [
    {
      "linuxDistribution": "ubuntu",
      "apacheFlavour": "apache2",
      "reloadCommand": "systemctl reload apache2",
      "restartCommand": "systemctl restart apache2"
    },
    {
      "linuxDistribution": "debian",
      "apacheFlavour": "apache2",
      "reloadCommand": "systemctl reload apache2",
      "restartCommand": "systemctl restart apache2"
    },
    {
      "linuxDistribution": "linuxmint",
      "apacheFlavour": "apache2",
      "reloadCommand": "systemctl reload apache2",
      "restartCommand": "systemctl restart apache2"
    },
    {
      "linuxDistribution": "rhel",
      "apacheFlavour": "httpd",
      "reloadCommand": "systemctl reload httpd",
      "restartCommand": "systemctl restart httpd"
    },
    {
      "linuxDistribution": "centos",
      "apacheFlavour": "httpd",
      "reloadCommand": "systemctl reload httpd",
      "restartCommand": "systemctl restart httpd"
    },
    {
      "linuxDistribution": "fedora",
      "apacheFlavour": "httpd",
      "reloadCommand": "systemctl reload httpd",
      "restartCommand": "systemctl restart httpd"
    },
    {
      "linuxDistribution": "sles",
      "apacheFlavour": "httpd-prefork",
      "reloadCommand": "apachectl graceful",
      "restartCommand": "apachectl restart"
    }
  ],
  "isFallbackForRestartRequired": true,
  "shouldExecuteStandardCommandFirst": false   // Optional field and can be added on-demand only when the user wants to execute the standard apache 
                                                                                                                                      // command first
}

Default Execution Behavior:

By default, AppViewX executes the predefined system (AppViewX-framed) restart command as the primary restart command. If this command fails and isFallbackForRestartRequired is set to true, AppViewX executes the corresponding standard Apache restart command as a fallback.

Configuring the Standard Command to Execute First:

Administrators can request AppViewX to execute the standard Apache restart command before the system restart command. To enable this behavior, the required DB script must be executed to set shouldExecuteStandardCommandFirst to true in the APACHE_LINUX_RELOAD_RESTART_COMMANDS configuration within the cert_metadata collection.

db.getCollection("cert_metadata").updateOne(
  { _id: "APACHE_LINUX_RELOAD_RESTART_COMMANDS" },
  { $set: { "objectMap.shouldExecuteStandardCommandFirst": true } }
);

• Legacy configuration: When SSLCertificateChainFile is present in the Apache SSL configuration file, the intermediate and root certificates are bundled and deployed to the specified Certificate Chain File Location.
• New configuration: When SSLCertificateChainFile is not present in the Apache SSL configuration file, any value specified for Certificate Chain File Location is ignored.

The script to be run before the certificate is pushed is called a pre-push script and the script to be run after the push is called a post-push script.

From the following options, select the location of the script file(s):

• In AppViewX
• In Device

If this option is enabled, the certificate being pushed will overwrite any existing certificates with the same identifier on the target system. This will also ensure that only the latest version of the certificate is available on the target system.

If it is disabled, the push operation will fail in the event of conflicts with the certificates on the target system.