You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently a user should copy contents of a cert and paste into form.
This should be fine if you are using a self signed cert but if a user uses LetsEncrypt to issue a real cert then instead we need a path to cert/key.
Ideally the TLS configuration should be simplified to avoid mistakes.
For example instead of two cert and key paths a user may just select a folder and internally we can check for fullchain.pem or privkey.pem.
Also by default the /etc/letsencrypt/live/ can be scanned on start and all certs loaded and then they can be used depending on a Host header.
Another one place to check is /etc/ssl/private/.
I'm not sure if the LE can be runned in Windows but for Linux and Mac this should work
The text was updated successfully, but these errors were encountered:
I agree that we should make it possible to pick a cert file instead of needing to paste in the string. Probably just adding a button to pick from a file, but still storing it as a string rather than a filepath.
I don't think we could scan that directory for certs because we wouldn't have permission to without prompting the user to "open" a directory in the filepicker.
You'll need to specify a dir because the certbot renews certs. And also on the reneweal it need a hook to restart a web server.
There is also another problem with file permissions: the /etc/letsencrypt/live/ is a root only folder. At least on Linux.
Currently a user should copy contents of a cert and paste into form.
This should be fine if you are using a self signed cert but if a user uses LetsEncrypt to issue a real cert then instead we need a path to cert/key.
Ideally the TLS configuration should be simplified to avoid mistakes.
For example instead of two cert and key paths a user may just select a folder and internally we can check for
fullchain.pem
orprivkey.pem
.Also by default the
/etc/letsencrypt/live/
can be scanned on start and all certs loaded and then they can be used depending on a Host header.Another one place to check is
/etc/ssl/private/
.I'm not sure if the LE can be runned in Windows but for Linux and Mac this should work
The text was updated successfully, but these errors were encountered: