| View Issue Details [ Jump to Notes ] | [ Issue History ] [ Print ] |
| ID | Project | Category | View Status | Date Submitted | Last Update |
| 0018371 | ClearOS | app-marketplace - Marketplace | public | 2017-12-20 05:52 | 2018-01-21 13:55 |
|
| Reporter | NickH | |
| Assigned To | bchambers | |
| Priority | normal | Severity | tweak | Reproducibility | always |
| Status | closed | Resolution | fixed | |
| Platform | | OS | | OS Version | |
| Product Version | 7.4.0 Updates | |
| Target Version | | Fixed in Version | 7.4.0 Updates | |
|
| Summary | 0018371: Remove references to OpenVPN in the Let's Encrypt app in the Marketplace |
| Description | In the marketplace widget for Let's Encrypt it says:
"Let's Encrypt is an open certificate authority that provides free SSL certificates. The app intelligently integrates the certificate lifecyle and management into Webconfig to be used by other services - Webconfig, website hosting, Openfire, OpenVPN etc."
This has been reported on the forum: https://www.clearos.com/clearfoundation/social/community/howto-letsencrypt-free-certficates-for-clearos-7-3#reply-201181 [^]
I do not believe the certificates integrate with OpenVPN at all and may give a big security risk if they did (OpenVPN only really checks if the certificate is signed by the same CA that the OpenVPN server uses which would enable anyone with a Let's Encrypt certificate to pass the certificate part of the OpenVPN validation).
..... and if fixing it, change the typo "lifecyle" to "lifecycle". |
| Tags | No tags attached. |
|
| Attached Files | |
|
Relationships 
Relationships