1 Topic by david.madman (edited by david.madman 2017-07-05 02:16:25)

  • david.madman
  • Member
  • Offline
  • Registered: 2017-07-05
  • Posts: 4

Topic: Cannot access Roundcube due to HSTS.

==== Required information ====
- iRedMail version (check /etc/iredmail-release):
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I am using 0.9.7 (latest version) on Ubuntu 16.04 64 bit with MariaDB and Nginx. I am not using the Pro version (yet).

I have successfully used 0.9.6 but decided to reinstall with 0.9.7 on my VPS.

I installed with no problems but when I connect to www.mydomain.com with Firefox I get: "The owner of www.mydomain.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website. This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate."

In 0.9.6 I was able to access the site by accepting an exception for the self-signed certificate.

In Chrome, I get: Welcome to nginx! If you see this page, the nginx web server is successfully installed and working. Further configuration is required."

My domain registrar DNS is pointed to Cloudflare and Cloudflare shows:

A www --> points to IP address.

A mydomain.com --> point to IP address.

A dc-f094903242332 --> points to IP address.

MX mydomain.com --> mail handled by dc-f094903242332,mydomain.com.

I have no idea what is wrong. I had no problems doing the same thing in 0.9.6. I just accepted the self-signed certificate and was able to access Roundcube. I can accept the self-signed certificate when I visit dc-f094903242332.mydomain.com

All help will be gratefully received.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,788

Re: Cannot access Roundcube due to HSTS.

*) Setup an valid SSL cert. Or,
*) You can disable HSTS support in Nginx config files. Comment out (or remove) the "include .../hsts.tmpl;" line in /etc/nginx/sites-conf.d/<site-name>/*.conf, then reload Nginx service.

3 Reply by david.madman (edited by david.madman 2017-07-06 00:31:49)

  • david.madman
  • Member
  • Offline
  • Registered: 2017-07-05
  • Posts: 4

Re: Cannot access Roundcube due to HSTS.

ZhangHuangbin wrote:

*) Setup an valid SSL cert. Or,
*) You can disable HSTS support in Nginx config files. Comment out (or remove) the "include .../hsts.tmpl;" line in /etc/nginx/sites-conf.d/<site-name>/*.conf, then reload Nginx service.

Thank you for your helpful reply.

Ls -R in /etc/nginx/sites-conf.d/ directory shows:

root@www:/etc/nginx/sites-conf.d# ls -R
.:
default  default-ssl

./default:
0-index.conf   0-root.conf         1-include-tmpl-redirect-to-https.conf  99-include-tmpl-php-catchall.conf
0-listen.conf  0-server_name.conf  99-include-tmpl-misc.conf

./default-ssl:
0-index.conf   0-server_name.conf            90-include-tmpl-iredadmin.conf  99-include-tmpl-misc.conf
0-listen.conf  1-include-tmpl-ssl.conf       90-include-tmpl-roundcube.conf  99-include-tmpl-php-catchall.conf
0-root.conf    90-include-tmpl-awstats.conf  90-include-tmpl-sogo.conf

There is no <site-name> and a grep -r on all files does not show any that contain "hsts".

I used Lets Encyrpt and successfully created a certificate. My /etc/nginx/sites-available/00-default.conf file shows:

# HTTP
server {
    include /etc/nginx/sites-conf.d/default/*.conf;

    listen 443 ssl;

    server_name www.mydomain.com;

    ssl on;
ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem;    
 # managed by Certbot
}

I now get a different error with Firefox: "400 Bad Request. The plain HTTP request was sent to HTTPS port."

I have the same error with Chrome.

I would appreciate a little more help. Thanks!

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,788

Re: Cannot access Roundcube due to HSTS.

david.madman wrote:

I now get a different error with Firefox: "400 Bad Request. The plain HTTP request was sent to HTTPS port."

File /etc/nginx/sites-available/00-default.conf is for port 80 (plain http), you should use /etc/nginx/sites-available/00-default-ssl.conf