4 results found

1. Conceptional failures of your SSL It! extension

   Your SSL It! plugin has some conceptional failures:

   1. You provide Mozillas Cipher Suites to adjust the three levels of Mozilla. I'm unsure, if you always then set the additional settings like nginx ssl session caching, but however, Mozillas Suites are not the best. Better is the rating table of Qualys SSL Labs, as that's the grade finally looking for. E.g. Mozillas most secure level requires EC certs, as you don't provide a way to order or install such certs with your normal SSL certificate dialogue (if don't want to order via Let's Encrypt or Encryption Everywhere program), so it's somehow useless. Also I won't see EC as such interesting as if quant computing will come, key length of a 384 bit EC is still 384 bit meanwhile a 4096 bit RSA is still 4096 bit and will not be first possible target.

   2. You provide OCSP setting, but I don't understand, why this setting should be done per domain. Why not enable at all for all sites or give possibility to choose?

   3. I'm unsure, how you handle alias domains, you recognize them, but will a certificate order (e.g. LE or EE) then will issue all separate certs or provide possibility to purchase one with all entries?

   4. HTTP to HTTPS redirection (if no cert available) still has its problems. If you have aliases, aliases will first redirect to https, so they need a cert just therefor (better to change the order of redirects) as well as you redirect from non-www to www first, if preferred domain is www, however, that's recognized as bad practice by HSTS preload list (would be fine to be linked to enter or check your site there) and could result in not been listed (so again wrong redirection order).

   5. As you also allow to protect webmail (however, you don't see, if it's protected already as in my situation), what's about MTA-STS support?

   Regards,
   Christian

   Your SSL It! plugin has some conceptional failures:

   1. You provide Mozillas Cipher Suites to adjust the three levels of Mozilla. I'm unsure, if you always then set the additional settings like nginx ssl session caching, but however, Mozillas Suites are not the best. Better is the rating table of Qualys SSL Labs, as that's the grade finally looking for. E.g. Mozillas most secure level requires EC certs, as you don't provide a way to order or install such certs with your normal SSL certificate dialogue (if don't want to order via Let's Encrypt or Encryption Everywhere program), so it's somehow… more

   3 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Web / SSL  ·  Delete…  ·  Admin →
   not a feature  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   If you believe you have found product issues, please open a ticket with Plesk support so that the issues can be addressed.

   -- PD

2. Please allow .pem files like before - or explain the change.

   Since some weeks, I'm not able to install Cloudflare generated origin server .pem files. Even the existing ones that worked before are now not accepted. I noticed you're promoting now different certificate solutions, that's ok - but I would like to install my .pem files like before. Any idea when you can activate this again? Thank you.

   •  

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Web / SSL  ·  Delete…  ·  Admin →
   not a feature  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for reporting this bug, we have confirmed it (bug ID for your reference: EXTSSLIT-1993). We are closing this request, since it does not contain any feature suggestions.

   — AY

3. Plesk should generate the TXT record for _acme-challenge regardless of the status of BIND

   If BIND has failed/does not start during Let's Encrypt certificate renewal, so there was no TXT record for _acme-challenge generated.
   Plesk should generate the TXT record regardless of the status of BIND.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Web / SSL  ·  Delete…  ·  Admin →
   not a feature  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Note, that only feature requests are allowed here. If you need to submit bugreport, please do it here: https://talk.plesk.com/forums/reports.746/
   Or contact Plesk Support Team.

   —
   IG

4. files without extension" show page not found

   make changes that "files without extension" show plain text. because this feature is used for domain validation while installing ssl. in version 12.5 we were able to verify domain by uploading files in directory, but in new version when we upload files and browse them by url it shows 404 not found.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Web / SSL  ·  Delete…  ·  Admin →
   not a feature  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Your request looks like bugreport than feature request. So we would appreciate if you post bugs and issues on our forum at https://talk.plesk.com/forums/reports.746/. We are closing this request, since it does not contain any feature suggestions. Thanks.
   —
   IG