Repository: certbot/certbot

Issue:
Add more context to "Easy vs Secure" prompt
Right now you get this prompt for redirect

```
Please choose whether HTTPS access is required or optional.
-------------------------------------------------------------------------------
1: Easy - Allow both HTTP and HTTPS access to these sites
2: Secure - Make all requests redirect to secure HTTPS access
-------------------------------------------------------------------------------
```

One confusing thing: The title asks "required or optional," but those words don't appear in either option.

Also, we should provide more advice on how to choose. I.e. 

```
1: Easy - Allow both HTTP and HTTPS access to these sites. Choose this if you haven't yet tested that your sites function properly when visited on HTTPS.
2: Secure - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration.
```



Discussion:
Related #3329. Weird that those issues were filed at exactly the same time...

Related: #3550

Does 2. include the HSTS header? If so then you cannot undo the change so easily...

It does not. If we were to enable HSTS, it would be with a much bigger warning.

There may or may not be a canonical issue I'm missing related to this, but if there's not I propose this issue to be that. Current thinking is to scrap easy, secure, custom, all of that, and have precise, specific choices for the user. Such as (with obvious placeholder text):

```
Please choose which optional security enhancements to enable:
-------------------------------------------------------------------------------
[x] 1: Redirect -  Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration.
[x] 2: OCSP Stapling - Grab a stapler, place a staple in the upper left corner of your cert
[ ] 3: HSTS - Spin the roulette wheel of permanent doom. Only enable if you've looked into this separately. We will probably even refuse to do this for you if we think your setup isn't secure enough.
-------------------------------------------------------------------------------
```

I guess that list would be built dynamically from a table of available enhancements that could grow over time?

Also, I wonder how you'd describe HPKP, which is even more dangerous for site availability than HSTS!

@schoen, yes, that's the idea.

```
[ ] 4: HPKP - Tell corporate network MITMs what you *really* think.
```

Luckily, a mechanism already exists for getting a [list of all enhancements supported by a plugin](https://github.com/certbot/certbot/blob/master/certbot/interfaces.py#L294).

```
Please choose which optional security enhancements to enable:
-------------------------------------------------------------------------------
[x] 1: Redirect - Make requests to :80 redirect HTTPS :443. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration.
[ ] 2: HSTS - Tell the browser to silently remap http: as https:.
[x] 3: OCSP Stapling - If your server does not have outbound internet access to {OCSP server} with an interval of daily you shouldn't try stapling
-------------------------------------------------------------------------------
```
For the last one, {OCSP server} should be replaced by the OCSP - URI field from the certificate that certbot just retrieved.
This will be fixed as part of #4027.

Resolving patch:
diff --git a/certbot/display/enhancements.py b/certbot/display/enhancements.py
--- a/certbot/display/enhancements.py
+++ b/certbot/display/enhancements.py
@@ -42,12 +42,14 @@ def redirect_by_default():
 
     """
     choices = [
-        ("Easy", "Allow both HTTP and HTTPS access to these sites"),
-        ("Secure", "Make all requests redirect to secure HTTPS access"),
+        ("No redirect", "Make no further changes to the webserver configuration."),
+        ("Redirect", "Make all requests redirect to secure HTTPS access. "
+            "Choose this for new sites, or if you're confident your site works on HTTPS. "
+            "You can undo this change by editing your web server's configuration."),
     ]
 
     code, selection = util(interfaces.IDisplay).menu(
-        "Please choose whether HTTPS access is required or optional.",
+        "Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.",
         choices, default=0,
         cli_flag="--redirect / --no-redirect", force_interactive=True)
 


Test patch: