2.1.23

Added​

• An SSL/TLS section: generate a signing request, install a certificate, see what is serving each domain, and manage what is stored.
• Contacts and calendar on a phone, presented as what it is — already running, one address for both.

Fixed​

• The server's own CPU, memory, disk and process list were readable by any reseller.
• A reseller losing an account went on counting it.

Notes​

Everything around SSL already existed here. A customer could turn AutoSSL on, and could upload a certificate somebody had issued them. What nothing on this server would do was the step in between: to get that certificate they first need a private key and a signing request. The only ways through were a shell they do not have, or one of the websites that generates the key for you — which means handing your private key to a stranger.

The key is now made on this server and stays on it. What leaves is the signing request, which carries no secret. A private key can be downloaded by nobody, the owner included: it never has to leave, and a key in a downloads folder is a key in a backup, an email attachment and a support ticket. Deleting one shreds it.

Every name in a request is checked against the account's own domains first — www. and wildcards included — because a request for a name you do not hold is one no authority would sign, and issuing it here would be this server vouching for somebody else's domain.

Manage SSL Hosts reads the certificate on disk rather than what was asked for, because the difference between those two is the reason the page exists. A self-signed certificate is called out separately from a trusted one: it encrypts, every browser still warns, and "has a certificate" is not the same as "works".

The four pages are four permissions rather than one switch. An operator may well want customers to see which certificate serves their site without letting them replace it.