Zpět na seznam změn
Backend panelu
v1.0.586
One TLS policy for every site: connections without forward secrecy are no longer accepted, main domains staple OCSP, and HSTS finally applies to Node and Python sites.
Vylepšení
2- TLS: main domains now staple the certificate revocation answer, as subdomains always have — one round trip less for the visitor, and the certificate authority no longer sees who visits your site.
- Disk: updating the panel interface no longer leaves every older copy behind. A release is removed only once it is older than every version the panel can still roll back to, so the installed version and all three rollback points keep their files; nothing from the last week is touched either. Measured on a test server: 523 MB on disk where 106 MB is in use.
Opravy chyb
3- HSTS: turning HSTS on for a domain had no effect on a Node or Python application site, because that renderer wrote no header at all. It now follows the domain setting and its max-age.
- Existing sites receive the TLS change: the vhost template is refreshed on the first start and the vhost files still carrying the old policy are re-rendered once — nginx validates everything once and reloads once, and if it refuses, every file is restored and nothing is reloaded.
- Webhooks: ssl.revoked is no longer offered — nothing in the panel revokes a certificate, so subscribing to it only produced silence. Existing subscriptions keep working and remain editable.
Bezpečnostní opravy
2- TLS: every generator now serves one cipher policy, the forward-secret list subdomains and webmail have always used. Measured on a live site: a connection with no forward secrecy (AES256-SHA) was accepted before this release and is refused after it. Ordinary browsers negotiate exactly what they did before.
- Updates: a package is no longer installed unless its SHA-256 is known. The endpoint used to accept whatever checksum the caller supplied, including none; it now resolves the published one itself and refuses the update if it cannot.