FR: More SSL options for DA

Arieh

Arieh

Verified User
Joined
May 27, 2008
Messages
1,236
Location
The Netherlands
Hello,

Currently I have SSL disabled but as I should have it enabled for obvious reasons, I wanted to enable it. But I stumbled upon a problem. When I set SSL=1, going to http://domain:2222 redirects you to the IP which gives an untrusted cert.

I know I can configure the redirect, so I could redirect it to a domain with a valid cert. But if I would redirect it to a domain of mine, resellers' customers will also have to deal with this domain.

I could set it to a whitelabel domain, who I also uses for nameservers, but it's not ideal.

So I was wondering if it would be possible to have more options in this, maybe something like:
- When SSL is enabled, make it an option and no redirect so http also keeps working
- Different redirect for a reseller (though I wonder how many resellers want a dedicated ip + cert only for this)
- ??

Any thought on this would be nice. :)
 
There are a few ways to do this. What you cannot do is have DirectAdmin answer both securely and insecurely on the same port (it's a limitation of the protocol, apache can't do it either). But you can advertise, for example, port 2222 for secure usage, and port 8080 (just an example) for insecure usage. Or the other way around.

Another thing you cannot do is have DirectAdmin use multiple Certificates; no matter what domain name/IP# you use for DirectAdmin it's still going to use only on Certificate; it's how it's written.

You may be able to use cp.example.com, where example.com is the reseller's domain name, and use a proxy running on the server to redirect to DirectAdmin. I've never tried it and I don't know the details of how to set it up.

What we and others do is exactly what you call not ideal; we use generic names. We use one for DirectAdmin logins (but we also allow insecure logins on a different port [search DirectAdmin forums and the knowledgebase]) at the user's domain name or the reseller's domain name, and we use another generic name for our nameservers.

And we use private or proxy registrations for those generic domain names.

Jeff
 
You must log in or register to reply here.
Back
Top