davift opened a new issue, #14074: URL: https://github.com/apache/cloudstack/issues/14074
### The required feature described as a wish ### The required feature described as a wish **Description:** TLS is not enabled by default on the Management server or System VMs. This insecure default persists until explicitly remediated by the administrator. **Affected Component:** Management UI / API, SSVM, CPVM **Impact:** An attacker with network access can trivially intercept or sniff management traffic, including administrator credentials (password and 2FA codes), session tokens, API keys, and sensitive configuration data. **Steps to Reproduce:** - Deploy ACS following the official documentation. - Navigate to http://<IP>:8080/ (no HTTPS redirect occurs). - Attempt to connect to https://<IP>:8443/ and confirm that the connection fails. - Capture traffic with Wireshark or `tcpdump` during a login session. - Observe that credentials and session tokens are transmitted in cleartext. **Recommended Remediation:** Enable TLS by default during installation. A self-signed certificate can be automatically generated and configured without any additional effort on the user's part. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
