Bug 42695 – Allow configuration for HTTP(S) exceptions even if apache2/force_https=yes

Bug 42695 - Allow configuration for HTTP(S) exceptions even if apache2/force_https=yes


Summary:	Allow configuration for HTTP(S) exceptions even if apache2/force_https=yes

Status:	RESOLVED DUPLICATE of bug 43603

Product:	UCS
Classification:	Unclassified
Component:	Apache
Version:	UCS 4.1
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UMC maintainers
QA Contact:

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2016-10-17 13:14 CEST by Michael Grandjean
Modified:	2017-05-19 13:42 CEST (History)
CC List:	2 users (show)

See Also:	43603
What kind of report is it?:	Feature Request
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:	2016101721000211
Bug group (optional):	External feedback
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Michael Grandjean

2016-10-17 13:14:49 CEST

The UCRV apache2/force_https=yes forces the use of encrypted connections by re-directing to https://

That's usually desired, at least for public-facing servers. But in some cases one needs exceptions:

One that springs to mind is the ACME protocol / Let's Encrypt clients. There you have a "Simple HTTP validation" that popular clients use to receive a new certificate¹.  To make this work you need to expose the ACME challenge tokens via HTTP (and not via HTTPS) at this fixed path:

http://fqdn.ofyour.server/.well-known/acme-challenge/

We already have a hardcoded exception for /server-status via Bug 40173
I think we should extend this to something more generic, e.g. specifying the path / URL for the exception via UCR.

¹ https://letsencrypt.github.io/acme-spec/#rfc.section.7.1

Comment 1 Michael Grandjean

2016-10-17 13:24:13 CEST

See also http://forum.univention.de/viewtopic.php?t=4655&p=22705#p22705

Comment 2 Florian Best

2016-10-18 11:53:36 CEST

Another good one might be 'http://$master/ucs-root-ca.crt'

Comment 3 Florian Best

2017-05-19 13:42:52 CEST

You can now simply set:
apache2/force_https/exclude/request_uri/letsencrypt=/.well-known/acme-challenge/

*** This bug has been marked as a duplicate of bug 43603 ***