Guys,

Cups has always been great, it either works or it doesn't. When it doesn't, it has been difficult to find good documentation to fix it. On Arch, I have run across an issue that seems simple, but I don't understand it enough to update the Arch wiki yet, so I'm looking for a bit of help.

Symptoms:

Cups web interface (on network server - not localhost) can be accessed fine, user is a member of 'lp' with lppasswd set giving user admin rights in the cups password digest (md5).

SystemGroup lp sys root wheel

ServerName, ServerAdmin, ServerAlias, Port, Listen and 'Location /', 'Location /admin' and 'Location /admin/conf' all properly set. /etc/hosts is correct.

In the web interface clicking on "admin" then "Add Printer" returns the error: "426 Upgrade Required" meaning cups tried to switch to ssl for the Add Printer feature and something has failed leaving the cups process hung. '/etc/rc.d/cups stop' has no effect, 'pidof cupsd' and then 'kill <pid>' has no effect. The only way to kill the hung process is 'kill -9 <pid>'

The cups web interface can "Edit Configuration File', 'View Access Log', 'View Error Log', etc. all work just fine with no hang, but if you try and 'Add Printer' the cups process hangs.

The httpd-ssl.conf is correct as are the /etc/httpd/certs. All other pages on the site can be accessed via https, but cups hangs for some reason.

Googling, easily turns up a workaround for cupsd.conf:

DefaultEncryption Never

Which prevents cups from ever switching to ssl for configuration via the web interface but doesn't explain why it is needed. I would like to understand why this workaround is needed and add this information to the https://wiki.archlinux.org/index.php/Cups page, but I don't understand why cups is hanging.

From the error log you have the entry:

Unable to set ACLs on root certificate "/var/run/cups/certs/0" - Operation not supported. That looks related to me.

Threads like:

https://bbs.archlinux.org/viewtopic.php?pid=756693 https://bbs.archlinux.org/viewtopic.php?id=85454

don't give any solutions - just more guessed at work-arounds.

Obviously, I'm not the only one bitten by this one:

https://bugs.archlinux.org/task/22895

but no solution or explanation there either.

Also, in all the arch bbs threads everybody says you have to use 'lp' as the SystemGroup -- why? Why not 'sys' or 'wheel' if you are already a member and you have proper entries in the cups password digest? It's just a group right? If it has to be used, then why isn't it the default?

If any cups expert can steer me straight on the SystemGroup requirement and why 'DefaultEncryption Never' is needed, I'm more than happy to write it up in the wiki. Anybody got an explanation or link I didn't find on these issues?