From bd2a4ea5ebabfeec04769f4ca552d98013a30a38 Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Tue, 30 Jun 2026 15:49:23 +0530 Subject: [PATCH 1/2] fix(migration): don't reclassify custom ssl sites as letsencrypt --- ...7101545_site-command_fix_ssl_flag_for_existing_le_certs.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php b/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php index 99c1bcfd..4a599357 100644 --- a/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php +++ b/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php @@ -51,7 +51,8 @@ public function up() { } if ( $crt_exists && $key_exists && $chain_exists ) { - if ( empty( $db_ssl ) || $db_ssl !== 'le' ) { + // Only repair sites with an unset SSL flag; never override an explicit custom/self/inherit (or le) choice. + if ( empty( $db_ssl ) ) { // Check if the cert is a valid Let's Encrypt cert using CertificateParser try { $crt_pem = file_get_contents( $crt ); From f2b3fd6c98c53cf9fcccf80e5955e1c63854048c Mon Sep 17 00:00:00 2001 From: Riddhesh Sanghvi Date: Thu, 24 Sep 2026 10:39:09 +0000 Subject: [PATCH 2/2] fix(migration): don't reclassify ssl-disabled sites as letsencrypt `ee site update --ssl=off` stores site_ssl as '0' and leaves the LE cert files on disk, so the `empty()` gate still flipped explicitly disabled sites back to `le` (renewed by cron and re-enabled on the next compose regeneration). Only repair a never-set flag (NULL or ''). --- ...101545_site-command_fix_ssl_flag_for_existing_le_certs.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php b/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php index 4a599357..e8d04efa 100644 --- a/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php +++ b/migrations/db/20250927101545_site-command_fix_ssl_flag_for_existing_le_certs.php @@ -51,8 +51,8 @@ public function up() { } if ( $crt_exists && $key_exists && $chain_exists ) { - // Only repair sites with an unset SSL flag; never override an explicit custom/self/inherit (or le) choice. - if ( empty( $db_ssl ) ) { + // Only repair a never-set flag (NULL/''); '0' is an explicit `--ssl=off`, other values are explicit SSL types. + if ( null === $db_ssl || '' === $db_ssl ) { // Check if the cert is a valid Let's Encrypt cert using CertificateParser try { $crt_pem = file_get_contents( $crt );