diff --git a/httpd-2.4.65-hcheck-stuck.patch b/httpd-2.4.65-hcheck-stuck.patch
new file mode 100644
index 0000000..315b9c2
--- /dev/null
+++ b/httpd-2.4.65-hcheck-stuck.patch
@@ -0,0 +1,66 @@
+--- a/modules/proxy/mod_proxy_hcheck.c
++++ b/modules/proxy/mod_proxy_hcheck.c
+@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state
+ sctx_t *ctx = (sctx_t *)data;
+ server_rec *s = ctx->s;
+ proxy_server_conf *conf;
++ proxy_worker **workers;
++ proxy_worker *worker;
++ apr_time_t now;
++ int i, n;
+
++ conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
++ balancer = (proxy_balancer *)conf->balancers->elts;
++
+ switch (state) {
+ case AP_WATCHDOG_STATE_STARTING:
+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258)
+ "%s watchdog started.",
+ HCHECK_WATHCHDOG_NAME);
++ /* set last update time for all workers */
++ now = apr_time_now();
++ for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
++ workers = (proxy_worker **)balancer->workers->elts;
++ for (n = 0; n < balancer->workers->nelts; n++, ++workers) {
++ worker = *workers;
++ if (worker->s->updated == 0) {
++ worker->s->updated = now;
++ }
++ }
++ }
+ #if HC_USE_THREADS
+ if (tpsize && hctp == NULL) {
+ rv = apr_thread_pool_create(&hctp, tpsize,
+@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state
+
+ case AP_WATCHDOG_STATE_RUNNING:
+ /* loop thru all workers */
+- if (s) {
+- int i;
+- conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
+- balancer = (proxy_balancer *)conf->balancers->elts;
+- ctx->s = s;
++ {
++ now = apr_time_now();
+ for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
+- int n;
+- apr_time_t now;
+- proxy_worker **workers;
+- proxy_worker *worker;
+ /* Have any new balancers or workers been added dynamically? */
+ ap_proxy_sync_balancer(balancer, s, conf);
+ workers = (proxy_worker **)balancer->workers->elts;
+- now = apr_time_now();
+- for (n = 0; n < balancer->workers->nelts; n++) {
++ for (n = 0; n < balancer->workers->nelts; n++, workers++) {
+ worker = *workers;
+ if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) &&
+ (worker->s->method != NONE) &&
+@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state
+ hc_check(NULL, baton);
+ }
+ }
+- workers++;
+ }
+ }
+ }
diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 5c271f7..5a3d8ed 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -33,7 +33,7 @@ sscg -q \
--cert-file /etc/pki/tls/certs/localhost.crt \
--cert-key-file /etc/pki/tls/private/localhost.key \
--ca-file /etc/pki/tls/certs/localhost.crt \
- --dhparams-file /tmp/dhparams.pem \
+ --no-dhparams-file \
--lifetime 365 \
--hostname $FQDN \
--email root@$FQDN
diff --git a/httpd.conf b/httpd.conf
index e49ab6a..ad5c7ee 100644
--- a/httpd.conf
+++ b/httpd.conf
@@ -199,6 +199,7 @@ LogLevel warn
# a CustomLog directive (see below).
#
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext
LogFormat "%h %l %u %t \"%r\" %>s %b" common
@@ -216,10 +217,11 @@ LogLevel warn
#CustomLog "logs/access_log" common
#
- # If you prefer a logfile with access, agent, and referer information
- # (Combined Logfile Format) you can use the following directive.
+ # If you prefer a logfile with access, agent, referer, and process/thread
+ # information (an extended Combined Logfile Format), you can use the
+ # following directive.
#
- CustomLog "logs/access_log" combined
+ CustomLog "logs/access_log" combined_ext
diff --git a/httpd.spec b/httpd.spec
index 8c6a76c..45f21c9 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -103,6 +103,7 @@ Patch30: httpd-2.4.64-separate-systemd-fns.patch
# Bug fixes
# https://bugzilla.redhat.com/show_bug.cgi?id=1397243
Patch60: httpd-2.4.43-enable-sslv3.patch
+Patch61: httpd-2.4.65-hcheck-stuck.patch
# Security fixes
# Patch200: ...
@@ -848,6 +849,9 @@ exit $rv
* Tue Dec 09 2025 Luboš Uhliarik - 2.4.66-1
- new version 2.4.66
+* Thu Nov 27 2025 Luboš Uhliarik - 2.4.65-5
+- Improve default httpd LogFormats for better support diagnostics
+
* Wed Nov 12 2025 Luboš Uhliarik - 2.4.65-3
- mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode
@@ -857,6 +861,10 @@ exit $rv
* Sat Oct 18 2025 Luboš Uhliarik - 2.4.65-1
- new version 2.4.65
+- mod_proxy_hcheck: reschedule health checks after child process restart
+
+* Mon Sep 08 2025 Luboš Uhliarik - 2.4.64-4
+- Add tmpfiles.d rules for /var directories (bootc compatibility)
* Thu Jul 24 2025 Fedora Release Engineering - 2.4.64-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
diff --git a/httpd.tmpfiles b/httpd.tmpfiles
index f148886..a845ab5 100644
--- a/httpd.tmpfiles
+++ b/httpd.tmpfiles
@@ -1,2 +1,9 @@
d /run/httpd 710 root apache
d /run/httpd/htcacheclean 700 apache apache
+d /var/log/httpd 700 root root -
+d /var/www 755 root root -
+d /var/www/html 755 root root -
+d /var/www/cgi-bin 755 root root -
+d /var/lib/httpd 700 apache apache -
+d /var/cache/httpd 700 apache apache -
+d /var/cache/httpd/proxy 700 apache apache -