[Bug] 在应用启用自动跳转到https后,绑定到其的域名无法申请证书
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 22.6k
- Forks
- 1.5k
- Avg merge
- 4h 30m
- Merged PRs (30d)
- 11
Description
What happened?
使用雷池自动申请证书时,如果证书中包含绑定到已启用http自动跳转https的应用之域名时,则申请或续期都会失败。具体表现为验证所需的 .well-known/ 路径被发送到应用上游服务器,返回上游服务器的响应,而非被雷池拦截处理并返回验证文件。因此Let's Encypt无法完成验证。而将相关服务的“http自动跳转https”临时关闭再申请证书,则可以成功。
How we reproduce?
将一个域名绑定到一个防护应用,该应用代理到有效的上游服务器,应用高级配置继承全局高级配置。全局高级配置中启用“http自动跳转https功能”。然后为此域名配置自动申请证书即可复现。再将“http自动跳转https“关闭,即可消除。
Expected behavior
无论全局或相关应用”http自动跳转https“是否开启,都应能正常申请SSL证书,而非需要在申请时手动临时关闭”http自动跳转https“功能,这样既麻烦也不能自动续期。即无论””http自动跳转https“是否开启,在申请证书时雷池都应将 .well-known/ 路径自动拦截处理,并暴露验证文件。
Error log
No response
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the automatic certificate issuance and renewal flow and the HTTP-to-HTTPS redirect handling; inspect how requests under /.well-known/ are routed before reaching the upstream. Reproduce with an application inheriting the global redirect setting, then verify issuance and renewal succeed with the redirect enabled and validation files are served.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100