Disable HTTPS

[jonjon]

I am running pfBlockerNG.

It cannot connect to Minemeld because of the self-signed certificate.

This is for my home, so I don't have a signed certificate to use.

Is it possible to simply disable SSL on the web server so I can get past the cert error?

Thanks

[jonjon · Accepted solution]

I tried this.

The result is:

http://server/feeds/inboundfeedhc  is not accessible at all.

Auhtentication fails when trying to log in to the main page.

 However, I found the answer.

Turns out pfblockerng has a state setting, "FLEX", to downgrade the SSL.

It's working now. Thanks for the help.

[lmori]

Hi @jonjon,

you can disable HTTPS by tweaking the nginx config in /etc/nginx/sites-enabled/minemeld-web, but I would strongly recommend against this for security reasons. Couldn't you create a new CA and a new certificate for MineMeld and add the CA to the list of trusted CAs of pfBlockerNG instead ? 

[jonjon]

I remarked out the https redirect and was able to the main page to run without encryption.

However, I still could not get to the feeds pages without doing https.

I don't know how to add trusted CAs to pfblockerng to work that angle.

I really only need the feeds pages to be unencrypted.

If that can only be acheived by unencyrpting the entire site, I'm not worried about the lost security. This is only for my home. And if someone is actually sniffing my packets or MitM on my home network, I've far far bigger problems than any data exposed from Minemeld.

[lmori]

Hi @jonjon,

DISCLAIMER: do this only for testing and only if it is really needed, never never in production !

Easy way is editing /etc/nginx/sites-enabled/minemeld-web file and change the first lines. Comment out the first server stanza, and change the server stanza to listen on port 80 with no ssl:

upstream app_server {
    server 127.0.0.1:5000 fail_timeout=0;
}

# server {
#    listen 80;
#    server_name ~(.+)$;
#    return 301 https://$1$request_uri;
# }

server {
    listen 80;
[...]

And then:

$ sudo service nginx restart

[jonjon · Accepted solution]

I tried this.

The result is:

http://server/feeds/inboundfeedhc  is not accessible at all.

Auhtentication fails when trying to log in to the main page.

 However, I found the answer.

Turns out pfblockerng has a state setting, "FLEX", to downgrade the SSL.

It's working now. Thanks for the help.

[newuser123]

Hi, may I know how do you downgrade the SSL.