Repository: caddyserver/caddy (language: go)

Issue:
"auto_https off" not honoured in certain cases
I noticed Caddy trying to connect to Let's Encrypt and ZeroSSL despite auto_https set to off
with a more complex configuration.

The following reduced examples show that automate is active for one domain name when using Caddyfile3:

```
# caddy version
v2.4.6 h1:HGkGICFGvyrodcqOOclHKfvJC0qTU7vny/7FhYp9hNw=
```

```
# cat Caddyfile1 
{
	auto_https off
}

https://

tls test.crt test.key

respond "Hello World"


# caddy adapt -pretty -config Caddyfile1 | grep -C 3 automate
# (no output)
```

```
# cat Caddyfile2
{
	auto_https off
}

https://example.com

tls test.crt test.key

respond "Hello World"


# caddy adapt -pretty -config Caddyfile2 | grep -C 3 automate
# (no output)
```

```
# cat Caddyfile3
{
	auto_https off
}

https://example.com,
https://

tls test.crt test.key

respond "Hello World"


# caddy adapt -pretty -config Caddyfile3 | grep -C 3 automate
		},
		"tls": {
			"certificates": {
				"automate": [
					"example.com"
				],
				"load_files": [
# 
```


Discussion / hints:
Please try with a build from master, it's possible we've already fixed these issues.
Please see the output below. From the output I'd guess the problem isn't fixed (however I didn't check if connections to Let's Encrypt/ZeroSSL are made or not):

```
$ git log -n 1
commit 734acc776a1156d22dabedd420053d834663a22e (HEAD -> master, origin/master, origin/HEAD)
Author: Francis Lavoie <lavofr@gmail.com>
Date:   Mon Mar 28 17:07:43 2022 -0400

    chore: Fix for xcaddy builds (#4665)
    
    * chore: Attempt fix for xcaddy builds
    
    * Upgrade smallstep/certificates which avoids the problem

$ ./caddy version
(devel)

$ ./caddy adapt -pretty -config Caddyfile3 | grep -C 3 automate
		},
		"tls": {
			"certificates": {
				"automate": [
					"example.com"
				],
				"load_files": [
$ 
```
For now, just split those up into two separate site blocks.

I'm not sure it really makes sense to have `https://` and `https://example.com` in the same site block, it's redundant.

Either way, it's an edgecase that should be covered, I guess.
Yes, for now I live with `https://` as it covers `https://example.com` as well. But I agree with you that this is a bug as it contradicts "auto_https off" and is different from Caddyfile1/2 with either address.

Fix patch:
diff --git a/caddyconfig/httpcaddyfile/tlsapp.go b/caddyconfig/httpcaddyfile/tlsapp.go
index 947512aaba3..240cb02d5dc 100644
--- a/caddyconfig/httpcaddyfile/tlsapp.go
+++ b/caddyconfig/httpcaddyfile/tlsapp.go
@@ -48,6 +48,10 @@ func (st ServerType) buildTLSApp(
 	if hsp, ok := options["https_port"].(int); ok {
 		httpsPort = strconv.Itoa(hsp)
 	}
+	autoHTTPS := "on"
+	if ah, ok := options["auto_https"].(string); ok {
+		autoHTTPS = ah
+	}
 
 	// count how many server blocks have a TLS-enabled key with
 	// no host, and find all hosts that share a server block with
@@ -331,10 +335,12 @@ func (st ServerType) buildTLSApp(
 	internalAP := &caddytls.AutomationPolicy{
 		IssuersRaw: []json.RawMessage{json.RawMessage(`{"module":"internal"}`)},
 	}
-	for h := range httpsHostsSharedWithHostlessKey {
-		al = append(al, h)
-		if !certmagic.SubjectQualifiesForPublicCert(h) {
-			internalAP.Subjects = append(internalAP.Subjects, h)
+	if autoHTTPS != "off" {
+		for h := range httpsHostsSharedWithHostlessKey {
+			al = append(al, h)
+			if !certmagic.SubjectQualifiesForPublicCert(h) {
+				internalAP.Subjects = append(internalAP.Subjects, h)
+			}
 		}
 	}
 	if len(al) > 0 {


Test patch:
diff --git a/caddytest/integration/caddyfile_adapt/tls_automation_policies_10.txt b/caddytest/integration/caddyfile_adapt/tls_automation_policies_10.txt
new file mode 100644
index 00000000000..b6832ad1b5a
--- /dev/null
+++ b/caddytest/integration/caddyfile_adapt/tls_automation_policies_10.txt
@@ -0,0 +1,58 @@
+# example from issue #4667
+{
+	auto_https off
+}
+
+https://, example.com {
+	tls test.crt test.key
+	respond "Hello World"
+}
+----------
+{
+	"apps": {
+		"http": {
+			"servers": {
+				"srv0": {
+					"listen": [
+						":443"
+					],
+					"routes": [
+						{
+							"handle": [
+								{
+									"body": "Hello World",
+									"handler": "static_response"
+								}
+							]
+						}
+					],
+					"tls_connection_policies": [
+						{
+							"certificate_selection": {
+								"any_tag": [
+									"cert0"
+								]
+							}
+						}
+					],
+					"automatic_https": {
+						"disable": true
+					}
+				}
+			}
+		},
+		"tls": {
+			"certificates": {
+				"load_files": [
+					{
+						"certificate": "test.crt",
+						"key": "test.key",
+						"tags": [
+							"cert0"
+						]
+					}
+				]
+			}
+		}
+	}
+}
\ No newline at end of file