2 ms·

Can I ask for a virtualmin feature here wrt SSL certs (and maybe specifically LE)? I know it's not the first request, but an easy way from the GUI to force all

Can I ask for a virtualmin feature here wrt SSL certs (and maybe specifically LE)? I know it's not the first request, but an easy way from the GUI to force all requests to be SSL would be great. The only way I see in GUI is a "redirect everything", but... that also redirects requests for ".well-known" which means renewal requests don't work (have been hit by this a few times). Some recommended ways of handling "always use SSL" with LE renewals would help. Thanks for VM work!

pfg 9y ago
> [...] that also redirects requests for ".well-known" which means renewal requests don't work What issue did you run into with this? Let's Encrypt follows redirects both to HTTP and HTTPS and accepts practically any certificate for redirect targets when validating via http-01, including self-signed, expired and mismatching certificates (which isn't a problem since the initial request is plaintext anyway).
SwellJoe 9y ago
That's a great request (though I thought .well-known would still work through an http->https redirect, as long as nothing else messed with the request; we do a redirect on virtualmin.com and our LE renewals work OK...but, I'll look deeper into that). It can be surprisingly tricky to get redirects right, because of how web apps behave and how web apps often take over early request processing in an htaccess file for things like nice URLs and special assets directories and such, and there can be surprising interactions between redirect rules, but I suspect we could make it work in the majority of cases pretty easily. I'll add it to my todo list.
- mgkimsal 9y ago
  we had a global redirect (from the gui - not sure what the screen name is) which was interfering. Removing that, things seemed to work. i suspect if you set up some defaults, most virtualmin users would adapt around those. (and thanks again)

pfg 9y ago

> [...] that also redirects requests for ".well-known" which means renewal requests don't work What issue did you run into with this? Let's Encrypt follows redirects both to HTTP and HTTPS and accepts practically any certificate for redirect targets when validating via http-01, including self-signed, expired and mismatching certificates (which isn't a problem since the initial request is plaintext anyway).

SwellJoe 9y ago

That's a great request (though I thought .well-known would still work through an http->https redirect, as long as nothing else messed with the request; we do a redirect on virtualmin.com and our LE renewals work OK...but, I'll look deeper into that). It can be surprisingly tricky to get redirects right, because of how web apps behave and how web apps often take over early request processing in an htaccess file for things like nice URLs and special assets directories and such, and there can be surprising interactions between redirect rules, but I suspect we could make it work in the majority of cases pretty easily. I'll add it to my todo list.

mgkimsal 9y ago
we had a global redirect (from the gui - not sure what the screen name is) which was interfering. Removing that, things seemed to work. i suspect if you set up some defaults, most virtualmin users would adapt around those. (and thanks again)