Fix cert settings

crates/defguard_core/src/cert_settings.rs

@@ -94,7 +94,7 @@ pub struct ExternalUrlSettingsConfig {
     pub key_pem: Option<String>,
 }
 
-fn ensure_https(url: &str) -> String {
+pub(crate) fn ensure_https(url: &str) -> String {
     if let Some(rest) = url.strip_prefix("http://") {
         format!("https://{rest}")
     } else {
@@ -239,10 +239,8 @@ pub async fn apply_external_url_settings(
     // Modify url schema if necessary
     let mut settings = Settings::get_current_settings();
     settings.public_proxy_url = match config.ssl_type {
-        ExternalSslType::None => public_proxy_url.to_string(),
-        ExternalSslType::LetsEncrypt | ExternalSslType::DefguardCa | ExternalSslType::OwnCert => {
-            ensure_https(public_proxy_url)
-        }
+        ExternalSslType::None | ExternalSslType::LetsEncrypt => public_proxy_url.to_string(),
+        ExternalSslType::DefguardCa | ExternalSslType::OwnCert => ensure_https(public_proxy_url),
     };
     update_current_settings(&mut *transaction, settings).await?;
 

crates/defguard_core/src/handlers/component_setup.rs

@@ -22,6 +22,7 @@ use defguard_common::{
             gateway::Gateway,
             initial_setup_wizard::{InitialSetupState, InitialSetupStep},
             proxy::Proxy,
+            settings::update_current_settings,
             wizard::Wizard,
         },
     },
@@ -55,6 +56,7 @@ use tracing::Instrument;
 
 use crate::{
     auth::{AdminOrSetupRole, SessionInfo},
+    cert_settings::ensure_https,
     enterprise::is_enterprise_license_active,
     letsencrypt::{ACME_TIMEOUT, acme_step_name, call_proxy_trigger_acme, parse_cert_expiry},
     setup_logs::scope_setup_logs,
@@ -1288,6 +1290,13 @@ pub async fn stream_proxy_acme(
                     }
                 }
 
+                // Ensure external url is HTTPS
+                let mut settings = Settings::get_current_settings();
+                settings.public_proxy_url = ensure_https(&settings.public_proxy_url);
+                if let Err(err) = update_current_settings(&pool, settings).await {
+                    error!("Failed to update Settings::public_proxy_url to HTTPs after successful ACME challenge: {err}");
+                }
+
                 // Post-wizard: broadcast certs to the proxy via bidi channel.
                 if let Some(ref tx) = proxy_control_tx {
                     let msg = ProxyControlMessage::BroadcastHttpsCerts {

crates/defguard_core/tests/integration/api/proxy_certs.rs

@@ -240,9 +240,9 @@ async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOp
         .send()
         .await;
     assert_eq!(response.status(), StatusCode::CREATED);
-    // Url schema changed to https
+    // Url schema didn't change yet
     let mut settings = Settings::get(&pool).await.unwrap().unwrap();
-    assert_eq!(settings.public_proxy_url, "https://edge.example.com");
+    assert_eq!(settings.public_proxy_url, "http://edge.example.com");
 
     let body: serde_json::Value = response.json().await;
     assert!(body["cert_info"].is_null());

web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx

@@ -46,9 +46,13 @@ const breadcrumbs = [
 ];
 
 export const SettingsCertificatesPage = () => {
+  const navigate = useNavigate();
+  const onBack = () => {
+    navigate({ to: '/settings' });
+  };
   return (
     <Page title={m.settings_page_title()}>
-      <Breadcrumbs links={breadcrumbs} />
+      <Breadcrumbs links={breadcrumbs} onBack={onBack} />
       <SettingsLayout
         suggestion={<ContextualHelpSidebar pageKey={ContextualHelpKey.SettingsCerts} />}
       >

web/src/pages/settings/SettingsCertificatesPage/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSslConfigStep.tsx

@@ -9,7 +9,6 @@ import { Button } from '../../../../../shared/defguard-ui/components/Button/Butt
 import { SizedBox } from '../../../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../../../shared/defguard-ui/types';
 import { downloadFile } from '../../../../../shared/utils/download';
-import caIcon from '../../../../SetupPage/assets/ca.png';
 import '../../../../SetupPage/autoAdoption/steps/style.scss';
 import { SettingsCoreCertificateWizardStep } from '../types';
 import { useSettingsCoreCertificateWizardStore } from '../useSettingsCoreCertificateWizardStore';
@@ -49,7 +48,6 @@ export const SettingsCoreCertificateWizardInternalUrlSslConfigStep = () => {
         certInfo={certInfo}
         caCertPem={caData?.ca_cert_pem}
         onDownloadCaCert={handleDownloadCaCert}
-        imageSrc={caIcon}
       />
       <SizedBox height={ThemeSpacing.Xl3} />
       <Controls>

web/src/pages/settings/SettingsCertificatesPage/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx

@@ -36,6 +36,7 @@ type AcmeStepState = {
   currentStep: AcmeStepId | null;
   isComplete: boolean;
   isProcessing: boolean;
+  isFailed: boolean;
   errorMessage: string | null;
   proxyLogs: string[];
 };
@@ -52,6 +53,7 @@ const defaultAcmeState: AcmeStepState = {
   currentStep: null,
   isComplete: false,
   isProcessing: false,
+  isFailed: false,
   errorMessage: null,
   proxyLogs: [],
 };
@@ -74,6 +76,7 @@ export const SettingsEdgeCertificateWizardExternalUrlSslConfigStep = () => {
       currentStep: event.step,
       isComplete: event.step === 'Done',
       isProcessing: event.step !== 'Done' && !event.error,
+      isFailed: Boolean(event.error),
       errorMessage: event.error
         ? (event.message ??
           m.initial_setup_auto_adoption_external_url_ssl_lets_encrypt_error_default())
@@ -301,6 +304,7 @@ export const SettingsEdgeCertificateWizardExternalUrlSslConfigStep = () => {
   const isLetsEncryptProcessing = sslType === 'lets_encrypt' && acmeState.isProcessing;
   const isLetsEncryptIncomplete =
     sslType === 'lets_encrypt' && !acmeState.isComplete && !acmeState.errorMessage;
+  const isLetsEncryptFailed = acmeState.isFailed;
 
   return (
     <WizardCard>
@@ -311,7 +315,9 @@ export const SettingsEdgeCertificateWizardExternalUrlSslConfigStep = () => {
           <Button
             text={m.controls_continue()}
             onClick={() => useSettingsEdgeCertificateWizardStore.getState().next()}
-            disabled={isLetsEncryptProcessing || isLetsEncryptIncomplete}
+            disabled={
+              isLetsEncryptProcessing || isLetsEncryptIncomplete || isLetsEncryptFailed
+            }
           />
         </div>
       </Controls>