Webmin: SSL certificate not trusted (webmin configured on port 10000)

Question

I have a working installation of Webmin with plenty of working sites on https already. I'm using cerbot / letsencrypt to create certificates and it seems to work just fine.

My issue now is that webmin is being accessed on https://example.com:1000 and it works, but the browser doesn't support the certificate as "valid" - it says "not secure" and the https has a strike-through line over it and it's marked red.

Why would that be? Do I have to use a proxy for 10000 port somehow to match it with 443? If I access just https://example.com it works (but something else resides here, not Webmin).

So how would I go about making SSL certificate work on a 10000 port ?

All info appreciated.

Solution

Your normal site running on port 443 is using the SSL you've installed but you haven't installed the same certification for your second site (Webmin running on port 10000). So your site is using a self-certified SSL, which isn't bad because you can trust it, because it's yours.

You can:

• Safely ignore it as it poses no security risk to you or your sites.
• Install the same SSL cert but this time for Webmin and not a virtual host within Webmin or Virtualmin.

Comments

[trainoasis]

So passwords are still sent via ssl when logging in to webmin? Why would a browser say otherwise ?

[Simon Hayter]

Yes, it's merely stating the certification is not trusted because it doesn't come from a reputable vendor. Click the padlock and it'll tell you more, or test it with SSL labs.

[trainoasis]

Yeah, it says "You should not enter any sensitive information on this site (for example, passwords or credit cards), because it could be stolen by attackers." hmm ? :D

[Simon Hayter]

Your not understanding the difference between a self-certified SSL and one that is provided by a vendor. Go research a little about it.