From 8963dcc128c739e012d6131639a79b35129d8b84 Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Tue, 30 Jun 2026 15:47:25 +0530 Subject: [PATCH 1/2] fix(ssl): block ssl-verify on non-letsencrypt sites --- src/helper/class-ee-site.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/helper/class-ee-site.php b/src/helper/class-ee-site.php index 08ad268e..5158a6fb 100644 --- a/src/helper/class-ee-site.php +++ b/src/helper/class-ee-site.php @@ -1678,6 +1678,11 @@ public function ssl_verify( $args = [], $assoc_args = [], $www_or_non_www = fals $this->site_data = get_site_info( $args ); } + // SSL verification issues a Let's Encrypt cert via ACME, which is meaningless for non-LE certs and would clobber custom/self/inherited ones. + if ( 'le' !== $this->site_data['site_ssl'] ) { + EE::error( 'SSL verification is only applicable to Let\'s Encrypt certificates.' ); + } + if ( ! isset( $this->le_mail ) ) { $this->le_mail = \EE::get_config( 'le-mail' ) ?? \EE::input( 'Enter your mail id: ' ); } From 23c1b883a043ca33970f2a91ca2d2b3f2368f896 Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Thu, 24 Sep 2026 10:39:02 +0000 Subject: [PATCH 2/2] fix(ssl): point ssl-verify on sites without ssl to site update A failed LE setup on create or alias change (init_le) clears site_ssl and tells the user to re-run `ee site ssl-verify`. The new guard rejected that with "only applicable to Let's Encrypt certificates", which reads wrong for a site that asked for LE. Sites without SSL now get an error that names `ee site update --ssl=le` (with `--wildcard` when needed), which issues the cert and also records SSL in the DB so the site is renewed. --- src/helper/class-ee-site.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/helper/class-ee-site.php b/src/helper/class-ee-site.php index 5158a6fb..6998fb21 100644 --- a/src/helper/class-ee-site.php +++ b/src/helper/class-ee-site.php @@ -1678,6 +1678,12 @@ public function ssl_verify( $args = [], $assoc_args = [], $www_or_non_www = fals $this->site_data = get_site_info( $args ); } + // A failed LE setup (init_le) clears site_ssl and suggests ssl-verify; point to the command that enables SSL properly. + if ( empty( $this->site_data['site_ssl'] ) ) { + $wildcard_flag = empty( $this->site_data['site_ssl_wildcard'] ) ? '' : ' --wildcard'; + EE::error( sprintf( 'SSL is not enabled on %1$s. Enable Let\'s Encrypt SSL with `ee site update %1$s --ssl=le%2$s`.', $this->site_data['site_url'], $wildcard_flag ) ); + } + // SSL verification issues a Let's Encrypt cert via ACME, which is meaningless for non-LE certs and would clobber custom/self/inherited ones. if ( 'le' !== $this->site_data['site_ssl'] ) { EE::error( 'SSL verification is only applicable to Let\'s Encrypt certificates.' );