jbowens/request-catcher

Your website doesn't work

Closed this issue · 2 comments

I've just tried to go to your website and it won't work.

When I go to the https version, I get an unsafe website that looks like a blog:

image

Fixed the http version.

Unfortunately, the tool doesn't support https because it allows arbitrary subdomains, and I don't have a wildcard tls certificate. Let's Encrypt doesn't support them. I could use Let's Encrypt to automatically retrieve TLS certificates for each subdomain as they're created, but there's no way to prevent abuse. If someone spams many subdomains, Let's Encrypt may rate limit the site blocking access to legitimate users.

My personal blog is hosted from the same ip address, hence querying port 443 will get to you my personal blog but "unsafe" because its certificates are for a hostname you did not request.

ah nice one. thanks for fixing it. Really useful service