Telnet enables plain text on SSL port

fred2014 · 09-25-2016, 07:08 AM

I expect I have a config problem here but I can't find it:

Connecting to my SSL (own certificate - not commercial) site
allows pages to be served in plain text when telnet is used.

Connecting using a browsers performs correctly.

EG:

http://example.com - fails correctly
https://example.com - works correct
http://example.com:80 - fails correct
https://example.com:443 - works correct

So far so good but using telnet:
[root@localhost ~]# telnet
telnet> open example.com 443
Trying 1.1.1.2...
Connected to example.com.
Escape character is '^]'.
GET /
Connection closed by foreign host.

OK that's good.

THIS IS THE ISSUE
[root@localhost ~]# telnet
telnet> open example.com 80 <-----------port 80
Trying 1.1.1.2...
Connected to example.com.
Escape character is '^]'.
GET /

Returns plain text HTML of the page
This should not work.

What I don't understand is why a browser functions correctly
but telnet does not - and what config I need to look at?

I've probably missed something by staring at it too long
can anyone see my issue?

TIA

af7567 · 09-25-2016, 09:20 AM

What have you done to prevent plain text working over port 80? If you have only set up your SSL certificate then that would not normally disable port 80 automatically. It would just add the port 443 HTTPS connection too.

I don't know why http://example.com would fail in the browser, unless you are using Firefox which seems to redirect to HTTPS if it knows that the site supports it.

To make sure that visitors are using HTTPS you could add a .htaccess file to your server which checks for a port 80 connection and the rewrites the URL to use HTTPS, there are a few examples on Google.

http://www.inmotionhosting.com/suppo...-htaccess-file

fred2014 · 09-25-2016, 10:18 AM

Found it - I had a spurious <virtualhost ..> uncommented in the middle of some text
which made a number of things behave oddly.

Quote:

Originally Posted by af7567

What have you done to prevent plain text working over port 80? If you have only set up your SSL certificate then that would not normally disable port 80 automatically. It would just add the port 443 HTTPS connection too.

Which would not make sense - why have plain text and encrypted text?
But yes I have belt and braces on that to prevent port 80 access you are correct.

Quote:

I don't know why http://example.com would fail in the browser, unless you are using Firefox which seems to redirect to HTTPS if it knows that the site supports it.

firefox had better not be re-routing users requests. That would constitute hacking.

Quote:

To make sure that visitors are using HTTPS you could add a .htaccess file to your server which checks for a port 80 connection and the rewrites the URL to use HTTPS, there are a few examples on Google.

http://www.inmotionhosting.com/suppo...-htaccess-file

thanks for the input but I prefer such things to be in the config files. Its a good deal more
efficient that way - and easier to control.