topic Re: Disable HTTPS in General Topics

Disable HTTPS

jonjon — Sun, 23 Oct 2016 02:17:12 GMT

I am running pfBlockerNG.

It cannot connect to Minemeld because of the self-signed certificate.

This is for my home, so I don't have a signed certificate to use.

Is it possible to simply disable SSL on the web server so I can get past the cert error?

Thanks

Re: Disable HTTPS

lmori — Mon, 24 Oct 2016 07:21:38 GMT

Hi @jonjon,

you can disable HTTPS by tweaking the nginx config in /etc/nginx/sites-enabled/minemeld-web, but I would strongly recommend against this for security reasons. Couldn't you create a new CA and a new certificate for MineMeld and add the CA to the list of trusted CAs of pfBlockerNG instead ?

Re: Disable HTTPS

jonjon — Wed, 26 Oct 2016 00:53:57 GMT

I remarked out the https redirect and was able to the main page to run without encryption.

However, I still could not get to the feeds pages without doing https.

I don't know how to add trusted CAs to pfblockerng to work that angle.

I really only need the feeds pages to be unencrypted.

If that can only be acheived by unencyrpting the entire site, I'm not worried about the lost security. This is only for my home. And if someone is actually sniffing my packets or MitM on my home network, I've far far bigger problems than any data exposed from Minemeld.

Re: Disable HTTPS

lmori — Thu, 27 Oct 2016 10:04:24 GMT

Hi @jonjon,

DISCLAIMER: do this only for testing and only if it is really needed, never never in production !

Easy way is editing /etc/nginx/sites-enabled/minemeld-web file and change the first lines. Comment out the first server stanza, and change the server stanza to listen on port 80 with no ssl:

upstream app_server {
    server 127.0.0.1:5000 fail_timeout=0;
}

# server {
#    listen 80;
#    server_name ~(.+)$;
#    return 301 https://$1$request_uri;
# }

server {
    listen 80;
[...]

And then:

$ sudo service nginx restart

Re: Disable HTTPS

jonjon — Fri, 28 Oct 2016 01:47:28 GMT

I tried this.

The result is:

http://server/feeds/inboundfeedhc is not accessible at all.

Auhtentication fails when trying to log in to the main page.

However, I found the answer.

Turns out pfblockerng has a state setting, "FLEX", to downgrade the SSL.

It's working now. Thanks for the help.

Re: Disable HTTPS

newuser123 — Wed, 08 May 2019 03:33:41 GMT

Hi, may I know how do you downgrade the SSL.