<h2>Edit File: fixtlsversions</h2><form method="post"><textarea name="content" rows="20" cols="80">#!/usr/local/cpanel/3rdparty/bin/perl
# cpanel - scripts/fixtlsversions                    Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

package scripts::fixtlsversions;

# This script is related to CPANEL-33512 and is expected to be
# of limited usefulness outside of the one-time task to ensure
# that TLSv1.2 is active for cpsrvd and other services.

use strict;
use warnings;
use Cpanel::LoadModule     ();
use Cpanel::SSL::Protocols ();
use Cpanel::ServerTasks    ();
use Cpanel::Imports;

use Getopt::Long &#039;GetOptionsFromArray&#039;;

exit run(@ARGV) unless caller;

sub run {
    my @args = @_;
    my ( $help, $dry_run, $update );
    GetOptionsFromArray(
        \@args,
        &#039;help&#039;    =&gt; \$help,
        &#039;dry-run&#039; =&gt; \$dry_run,
        &#039;update&#039;  =&gt; \$update,
    ) || return _usage(1);
    return _usage(0) if $help;
    return _usage(1) unless $dry_run xor $update;

    my $obj = __PACKAGE__-&gt;new( update =&gt; $update );

    $obj-&gt;logmsg(&#039;Ensuring that web-accessible services have TLSv1.2 active …&#039;);

    for my $try ( 1, 2 ) {
        $obj-&gt;adjust_cpsrvd_and_cpdavd();
        $obj-&gt;adjust_apache();

        if ( $obj-&gt;{failed} ) {
            $obj-&gt;logmsg( sprintf( &#039;%d error(s) occurred.&#039;, $obj-&gt;{failed} ) );
            if ( $try == 1 ) {
                $obj-&gt;logmsg(&#039;Trying again …&#039;);
                delete $obj-&gt;{failed};
                sleep 2;
            }
        }
        else {
            $obj-&gt;logmsg(&#039;Done.&#039;);
            last;
        }
    }

    return $obj-&gt;{failed} ? 1 : 0;
}

sub new {
    my ( $package, %opts ) = @_;
    return bless {%opts}, $package;
}

sub adjust_cpsrvd_and_cpdavd {
    my ($self) = @_;

    for my $service (qw(cpsrvd cpdavd)) {
        my $module = &quot;Cpanel::ServiceConfig::$service&quot;;
        Cpanel::LoadModule::load_perl_module($module);

        my $conf_obj    = $module-&gt;new();
        my $settings_hr = $conf_obj-&gt;get_config(1);

        my $old_string = $settings_hr-&gt;{SSLVersion};
        my $new_string = Cpanel::SSL::Protocols::upgrade_version_string_for_tls_1_2( $settings_hr-&gt;{SSLVersion}, &#039;_&#039; );
        $settings_hr-&gt;{SSLVersion} = $new_string;

        if ( $new_string ne $old_string ) {
            if ( $self-&gt;{update} ) {
                eval {
                    $conf_obj-&gt;validate($settings_hr) or die &quot;Failed to validate configuration\n&quot;;
                    my ( $save_ok, $save_msg ) = $conf_obj-&gt;save_datastore($settings_hr);
                    $conf_obj-&gt;update_config($settings_hr);
                    Cpanel::ServerTasks::queue_task( [&#039;CpServicesTasks&#039;], &quot;restartsrv $service&quot; );
                };
                if ( my $exception = $@ ) {
                    $self-&gt;logmsg(&quot;&#039;$service&#039; failed to update TLS protocols: $exception&quot;);
                    ++$self-&gt;{failed};
                }
                else {
                    $self-&gt;logmsg(&quot;&#039;$service&#039; switched $old_string to $new_string&quot;);
                }
            }
        }
        else {
            $self-&gt;logmsg(&quot;&#039;$service&#039; left $old_string unchanged&quot;);
        }
    }
    return;
}

sub adjust_apache {
    my ($self) = @_;

    require Cpanel::EA4::Conf;
    my $conf       = Cpanel::EA4::Conf-&gt;instance();
    my $old_string = $conf-&gt;sslprotocol;
    my $new_string = Cpanel::SSL::Protocols::upgrade_version_string_for_tls_1_2_apache($old_string);
    my $current    = $conf-&gt;sslprotocol($new_string);
    if ( $new_string ne $old_string ) {
        if ( $self-&gt;{update} ) {
            eval {
                $conf-&gt;save;
                Cpanel::ServerTasks::queue_task( [&#039;ApacheTasks&#039;], &#039;build_apache_conf&#039; );
            };
            if ( my $exception = $@ ) {
                $self-&gt;logmsg(&quot;&#039;httpd&#039; failed to update TLS protocols: $exception&quot;);
                ++$self-&gt;{failed};

                # rebuild conf but save restart for the next time it&#039;s necessary
            }
            else {
                $self-&gt;logmsg(&quot;&#039;httpd&#039; switched $old_string to $new_string&quot;);
            }
        }
    }
    else {
        $self-&gt;logmsg(&quot;&#039;httpd&#039; left $old_string unchanged&quot;);
    }
    return;
}

sub logmsg {
    my ( $self, $msg ) = @_;
    return logger()-&gt;info( sprintf( &#039;%s%s&#039;, $self-&gt;{update} ? &#039;&#039; : &#039;(dry run) &#039;, $msg ) );
}

sub _usage {
    my ($error) = @_;
    my $usage = &lt;&lt;EOU;
usage: $0 --dry-run | --update

You must specify one or the other, and you may not specify both.

--dry-run: Do everything (including log messages) except make the actual changes

--update: Make the changes
EOU

    if ($error) {
        print STDERR $usage;
        return 1;
    }
    print $usage;
    return 0;
}
</textarea><br><input type="hidden" name="edit_file" value="fixtlsversions"><input type="submit" value="Save"></form>