chaitin / chaitin/SafeLine

[Bug] 在应用启用自动跳转到https后,绑定到其的域名无法申请证书

Open
#1,310 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

released
Dominant language
Go
Stars
22.6k
Forks
1.5k
Avg merge
4h 30m
Merged PRs (30d)
11

Description

What happened?

使用雷池自动申请证书时,如果证书中包含绑定到已启用http自动跳转https的应用之域名时,则申请或续期都会失败。具体表现为验证所需的 .well-known/ 路径被发送到应用上游服务器,返回上游服务器的响应,而非被雷池拦截处理并返回验证文件。因此Let's Encypt无法完成验证。而将相关服务的“http自动跳转https”临时关闭再申请证书,则可以成功。

How we reproduce?

将一个域名绑定到一个防护应用,该应用代理到有效的上游服务器,应用高级配置继承全局高级配置。全局高级配置中启用“http自动跳转https功能”。然后为此域名配置自动申请证书即可复现。再将“http自动跳转https“关闭,即可消除。

Expected behavior

无论全局或相关应用”http自动跳转https“是否开启,都应能正常申请SSL证书,而非需要在申请时手动临时关闭”http自动跳转https“功能,这样既麻烦也不能自动续期。即无论””http自动跳转https“是否开启,在申请证书时雷池都应将 .well-known/ 路径自动拦截处理,并暴露验证文件。

Error log

No response

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the automatic certificate issuance and renewal flow and the HTTP-to-HTTPS redirect handling; inspect how requests under /.well-known/ are routed before reaching the upstream. Reproduce with an application inheriting the global redirect setting, then verify issuance and renewal succeed with the redirect enabled and validation files are served.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.