Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.2

http-redirect-to-https

Globalrestart requiredset by the Hub

Whether to forbid unencrypted connections to the web monitor
in the configuration this is a linehttp-redirect-to-https trueinside the block Global
The only line that makes monitor encryption mandatory

The monitor port answers both a plain request and a TLS handshake — we checked this on a fleet node. The client chooses for itself, and by default it will choose whatever is simpler. This line takes the choice away from it: with true plain connections are redirected to https.

The default changed between versions. In PowerMTA 4.5 it was false, since version 5.0 it is true. The manual warns: to turn off the redirect on 5.0 and above, false has to be written explicitly.

Without it the monitor’s whole set of TLS settings means nothing. Version bounds, cipher lists, preference order — all of that is about connections that got as far as encryption. A client for which it is simpler not to encrypt will not notice any of these settings.

And the management key goes through the monitor — in the X-API-Key header, inside the conversation. An unencrypted conversation means the key on the wire.

The main trap is turning the line off for the sake of a self-signed certificate. The client does not trust the monitor’s certificate, the developer sets false, and instead of one trust problem you get another — an exposed key on the wire. The cure is to teach the client to trust the certificate, not to remove encryption.
What the Hub does. It writes it — and writes false. Polling goes over plain http://, because the monitor’s certificate is self-signed and the Laravel client verifies the chain by default.

🔴 The price of this decision is the management key in plain text on every poll (see http-api-key). Checked on a fleet node: the port already answers over TLS 1.3, and nothing needs to change on the node. The fix is on our side: verify => false in the client or pinning the webmon.pem taken at installation — and true in the template.

Recommended values

There is one choice, and it is about whether the client trusts the certificate:

Value When
true (default since 5.0) always, if the client can trust the monitor’s certificate
false the client cannot — a temporary measure, not a solution

The monitor has its own certificate, configured not by a line but by the /var/lib/pmta/webmon.pem file.

The true default since version 5.0, false in 4.5 and the requirement to write false explicitly come from the manual (§ 3.3.1.58.2). That the port answers both over TLS and over a plain connection is our check on a fleet node.
Example configuration
# monitor encryption becomes mandatory only with this line
http-mgmt-port 1000
http-tls-min-version tlsv1.2
http-redirect-to-https true
The second line without the third guarantees nothing: the client simply will not encrypt. The version bound and the ban on plain connections are set together.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Expecting the old default on version 5.0 and above

§ 3.3.1.58.2

What it costsThe default changed to true starting with 5.0. A client that does not understand redirects stops working after an upgrade without a single configuration edit.
How to spot itAfter an engine upgrade the client gets 301 instead of data.
How to do it rightEither teach the client to use https or write false explicitly — the manual requires exactly an explicit entry.

Turning off the redirect because of a self-signed certificate

our experience

What it costsA trust problem turns into a plain text problem: the management key, which gives full access to the node, travels over the network unencrypted.
How to spot itThe configuration has false, and the client sends X-API-Key.
How to do it rightKeep true, and on the client side either turn off chain verification or pin the monitor’s certificate.

Configuring versions and ciphers while leaving the redirect off

our experience

What it costsNone of the TLS settings apply: the client chooses an unencrypted connection and never gets to negotiation.
How to spot itThe bounds and lists are set, but there is not a single handshake in the log.
How to do it rightSet true — it is the first line, not the last.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-redirect-to-https <boolean>
Values
yes | no | true | false
Default
true § 3.3.1.58.2
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
There is no inheritance: the line is written at the root of the file, in the Global section, and applies to the node’s whole management interface. It has no split by addresses or by API.
⇄

Related directives

2 relations

Works together with

http-accessGlobalOne decides whom to let in, the other whether they come encrypted. inference

Applies to

http-mgmt-portGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.2

Referenced from

http-tls-min-versionGlobalWhile plain connections are also accepted, the whole set of TLS settings decides nothing: the client simply will not encrypt. inferencehttp-tls-max-versionGlobalWhile plain connections are also accepted, the whole set of TLS settings decides nothing. inference

How to check on the node
We look at what the monitor answers to a plain request:
curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://NODE:1000/status
A 301 or 302 code with an https:// address means the redirect is on. 200 or 403 means the plain connection was accepted as is, and everything sent over it went in plain text.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Managed at
Infrastructure → Node parameters
Value
The Hub picks it itself — pace, warm-up stage, metrics
Cost of a mistake
reversible: harms only while it is set
Scenarios
Node security
Neighboring settings of the block Global:run-as-roothttp-accesshttp-api-keyhttp-csrf-protectionlog-file-world-readableAll 108 directives of the block →