News for hackers. Stuff that matters.

A comment on Caddy is the first and only web server to use HTTPS automatically and by default.

Re:Caddy is the first and only web server to use HTTPS autom... by dxuh on Tuesday September 12, 2023 @05:36AM (#37478656)
I'm always a bit bothered by them saying they are the "only" web server that can do this. First you can also just configure it in a way where it will not use HTTPS (e.g. if you provide an IP:port instead of a hostname). And if you do require specific configuration to enable HTTPS and automatically get certificates via ACME, then lots of other web servers can do this too. Even my own web server can do it: https://github.com/pfirsich/htcpp (see https://github.com/pfirsich/htcpp/blob/main/configs/acme.jom... for an admittedly much more complicated config).
[ Parent | on HN ]
Re:Caddy is the first and only web server to use HTTPS autom... by mholt on Tuesday September 12, 2023 @09:46AM (#37481195)
> if you provide an IP:port instead of a hostname

That still gets served over HTTPS.

The only time HTTPS isn't used is if a host portion is missing entirely (IP or name).

[ Parent | on HN ]
Re:Caddy is the first and only web server to use HTTPS autom... by lyeager on Tuesday September 12, 2023 @10:25AM (#37481808)
Or if you explicitly prefix the hostname with http://
[ Parent | on HN ]
Re:Caddy is the first and only web server to use HTTPS autom... by mholt on Tuesday September 12, 2023 @12:10PM (#37483445)
True, you can definitely turn HTTPS off explicitly.
[ Parent | on HN ]
Re:Caddy is the first and only web server to use HTTPS autom... by dxuh on Tuesday September 12, 2023 @01:42PM (#37484767)
I didn't even know about that. Thanks!
[ Parent | on HN ]
Re:Caddy is the first and only web server to use HTTPS autom... by francislavoie on Tuesday September 12, 2023 @12:13PM (#37483499)
The distinction is that Caddy is the only webserver* that enables HTTPS by default. All others don't attempt to enable HTTPS by default, they start with HTTP and you need to add config to make it use HTTPS. Nor do they enable ACME by default. With Caddy you only need to tell it your domain name and it'll do the rest.

* popular webserver anyway; we can't reasonably count yours with only 6 github stars that we've never heard of :P

[ Parent | on HN ]