3 ms·

Let's Encrypt is just about the best thing to happen to the web this decade. It really is huge to have encryption be something that can Just Work. It is, by far

Let's Encrypt is just about the best thing to happen to the web this decade. It really is huge to have encryption be something that can Just Work. It is, by far, the most popular feature we've added to Virtualmin in many years (and we had support from very early on due to the high demand for it). Wildcard certs have been a common request, but you can already specify multiple domains using SAN. And, since you can issue a new LE cert on-demand, it's actually not necessary for a lot of use cases that would have required a wildcard in the past. In the bad old days, getting a new certificate (even just to change details like adding a name to it) was time-consuming and often cost money. Most of the time when our users have needed a wildcard, it was just because they wanted to save a little money by having all of their subdomains on one cert; and not so much that they really needed to be able to spring up dozens/hundreds/thousands of new subdomains that could just automatically be secured. If you have a fixed number of names that need SSL with the same cert, you can already do that today with Let's Encrypt. Nonetheless, this is great. I'm just super impressed by how effective the LE folks have been at improving the state of security on the web, and for free! They really deserve every kind word and every donation dollar that comes their way.

mgkimsal 9y ago
Can I ask for a virtualmin feature here wrt SSL certs (and maybe specifically LE)? I know it's not the first request, but an easy way from the GUI to force all requests to be SSL would be great. The only way I see in GUI is a "redirect everything", but... that also redirects requests for ".well-known" which means renewal requests don't work (have been hit by this a few times). Some recommended ways of handling "always use SSL" with LE renewals would help. Thanks for VM work!
- pfg 9y ago
  > [...] that also redirects requests for ".well-known" which means renewal requests don't work What issue did you run into with this? Let's Encrypt follows redirects both to HTTP and HTTPS and accepts practically any certificate for redirect targets when validating via http-01, including self-signed, expired and mismatching certificates (which isn't a problem since the initial request is plaintext anyway).
- SwellJoe 9y ago
  That's a great request (though I thought .well-known would still work through an http->https redirect, as long as nothing else messed with the request; we do a redirect on virtualmin.com and our LE renewals work OK...but, I'll look deeper into that). It can be surprisingly tricky to get redirects right, because of how web apps behave and how web apps often take over early request processing in an htaccess file for things like nice URLs and special assets directories and such, and there can be surprising interactions between redirect rules, but I suspect we could make it work in the majority of cases pretty easily. I'll add it to my todo list.
  - mgkimsal 9y ago
    we had a global redirect (from the gui - not sure what the screen name is) which was interfering. Removing that, things seemed to work. i suspect if you set up some defaults, most virtualmin users would adapt around those. (and thanks again)

mgkimsal 9y ago

Can I ask for a virtualmin feature here wrt SSL certs (and maybe specifically LE)? I know it's not the first request, but an easy way from the GUI to force all requests to be SSL would be great. The only way I see in GUI is a "redirect everything", but... that also redirects requests for ".well-known" which means renewal requests don't work (have been hit by this a few times). Some recommended ways of handling "always use SSL" with LE renewals would help. Thanks for VM work!

pfg 9y ago
> [...] that also redirects requests for ".well-known" which means renewal requests don't work What issue did you run into with this? Let's Encrypt follows redirects both to HTTP and HTTPS and accepts practically any certificate for redirect targets when validating via http-01, including self-signed, expired and mismatching certificates (which isn't a problem since the initial request is plaintext anyway).
SwellJoe 9y ago
That's a great request (though I thought .well-known would still work through an http->https redirect, as long as nothing else messed with the request; we do a redirect on virtualmin.com and our LE renewals work OK...but, I'll look deeper into that). It can be surprisingly tricky to get redirects right, because of how web apps behave and how web apps often take over early request processing in an htaccess file for things like nice URLs and special assets directories and such, and there can be surprising interactions between redirect rules, but I suspect we could make it work in the majority of cases pretty easily. I'll add it to my todo list.
- mgkimsal 9y ago
  we had a global redirect (from the gui - not sure what the screen name is) which was interfering. Removing that, things seemed to work. i suspect if you set up some defaults, most virtualmin users would adapt around those. (and thanks again)