AutoSSL and Proxy Subdomains

[joako]

Yes, with the exception of proxy subdomains or wildcard domains. The following document includes additional information about this feature you may find helpful:

Manage AutoSSL - Documentation - cPanel Documentation

Thanks!

Any plans to ever get the webmail, cpanel interface, mailman, etc properly secured? It's all been broken for quite a while.

 

[cPanelMichael]

Hello,

I've moved this post into it's own thread.

There's no update to report at this time. However, you can find the most recent update on proxy subdomains and the AutoSSL feature at:

SSL certificate per domain on cpanel, webmail, dav, caldav, and whm services (SNI).

You may also want to vote and add feedback to these feature requests:

Support for per domain proxy subdomain certificates
Allow to make certificate for subdomains like cPanel.example.com and mail.Example using Lets Encrypt

Thank you.

 

[joako]

That feature says it doesn't work with proxy domains.

 

[cPanelMichael]

That feature says it doesn't work with proxy domains.

Hello,

Yes, that's accurate. Support for AutoSSL with proxy subdomains is not available, but you can follow the progress on the feature requests referenced in the previous response.

Thank you.

 

[joako]

So what are you guys doing to have SSL working everywhere in Cpanel?

 

[cPanelMichael]

So what are you guys doing to have SSL working everywhere in Cpanel?

Hello @joako,

As of cPanel 64, the AutoSSL functionality offers support for proxy subdomains:

64 Release Notes - Version 64 Documentation - cPanel Documentation

Is there a particular service or URL that is not working with SSL?

Thank you.

 

[joako]

So just to be clear this means when I go to https://webmail.domain.com:443 or https://cpanel.domain.com:443 it will access it directly without any redirect? And there's no need to hack the httpd.conf or go into every account and manually create a subdomain or redirect?

 

[cPanelMichael]

New So just to be clear this means when I go to https://webmail.domain.com:443 or https://cpanel.domain.com:443 it will access it directly without any redirect? And there's no need to hack the httpd.conf or go into every account and manually create a subdomain or redirect?

Hello,

That's correct, however the use of port 443 in the URL is unnecessary.

Thank you.

 

[joako]

I'm having issues now working around the many hacks used before this bug was fixed prevent the "hackers are trying to steal your credit card errors" messages.

How can I tell WHM to recreate the webmail proxy subdomains?

 

[cPanelMichael]

How can I tell WHM to recreate the webmail proxy subdomains?

Hello,

Are you referring to the records in the DNS zones? If so, and if you are okay with replacing the proxy subdomain records (e.g. cpanel, whm, webmail) for all accounts on the system with the default entries, then you could use the following script:

# /scripts/proxydomains --help
Usage:
    proxydomains [action] [options]

        Options:
          --help                          Brief help message
          --man                           Full help message
          --user=                         User to configure
          --domain=                       Domain to configure
          --subdomain=                    Proxy subdomain to manipulate
          --no_replace=0                  Enable replacment of existing records (currently
                                          only used for changing autodiscover hosts)
          --old_autodiscover_host=        The previously configured autodiscover host (used
                                          for matching old records and updating them to the
                                          new host)
          --force_autodiscover_support=1  Behave as if the autodiscover support has not been
                                          disabled even if it has. This is useful for
                                          removing the autodiscovery proxy subdomains after
                                          the support for them has been disabled.
          --ifenabled                     Only perform the operation if proxy subdomains
                                          are enabled.

        Actions:
          add          Create proxy subdomains
          remove       Remove proxy subdomains

Thank you.