$ sudo debconf-show ssl-cert
  make-ssl-cert/hostname: localhost
$ sudo dpkg-reconfigure ssl-cert
$ sudo dpkg-reconfigure -p low -f dialog ssl-cert

dpkg-reconfigure is expected to re-ask the debconf questions (which were not asked at install time, presumably due to a low priority). But it doesn't in this case. What causes this?

I'm asking out of curiosity. Having looked at /var/lib/dpkg/info/ssl-cert.postinst, I don't think changing the hostname question would affect the installed certificate. (You have to use make-ssl-cert generate-default-snakeoil --force-overwrite instead, as per the wiki).

The above results come from a Debian Stretch system.


dpkg-reconfigure ssl-cert doesn’t ask any questions by default because it doesn’t do anything by default. The postinst itself only asks questions in some circumstances if it finds a vulnerable snakeoil key. The make-ssl-cert script, which is called by postinst, aborts quickly if the snakeoil certificate is already installed; even if the snakeoil certificate needs to be installed, make-ssl-cert does so without asking any questions.

The only time make-ssl-cert asks questions using debconf is when it’s called manually with parameters other than generate-default-snakeoil.

  • Actually I got the last part wrong, see my update. This whole setup is rather unusual: it uses debconf variables, but only for manual invocations... – Stephen Kitt Jul 20 '17 at 16:55
  • Thanks! Additionally dpkg-preconfigure asks no questions for ssl-cert, and this is simply because there is no ssl-cert.config script. More details: dpkg-preconfigure dpkg-reconfigure. – sourcejedi Jul 20 '17 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.