Werk #22268: omd: Set X-Forwarded-Proto/-Ssl headers for sites automatically
| Component | Site management | ||||
| Title | omd: Set X-Forwarded-Proto/-Ssl headers for sites automatically | ||||
| Date | Sep 16, 2026 | ||||
| Level | Prominent Change | ||||
| Class | New Feature | ||||
| Compatibility | Incompatible - Manual interaction might be required | ||||
| Checkmk versions & editions |
|
Sites use the X-Forwarded-Proto and X-Forwarded-Ssl headers to tell whether
a client connected via HTTPS. Without them, a site accessed via HTTPS can
generate http:// URLs and redirects.
The system Apache configuration of a site now sets these headers automatically, only for requests to that site's URLs, so sites on the same system Apache don't affect each other.
This needs the Apache module mod_headers. The Checkmk packages enable it on
installation. If you disabled it, enable it again (for example with
a2enmod headers on Debian, Ubuntu and SLES) and restart Apache. Without
mod_headers the headers are silently not set.
After this update, first choose the APACHE_FORWARDED_HEADERS setting of every site:
auto(default): your system Apache terminates TLS itself or receives requests directly from clients. RequestHeader directives you added as described in the user guide (https://docs.checkmk.com/latest/en/omd_https.html) are no longer needed, but do no harm.manual: your system Apache sits behind another proxy or load balancer that terminates TLS. Withauto, the system Apache would overwrite the proxy's headers withhttpand the site would generate wrong URLs. Set it on the stopped site withomd config SITE set APACHE_FORWARDED_HEADERS manual. Checkmk then passes the proxy's headers through unchanged.
Then run omd update-apache-config SITE as root for every site. omd update
does not do this for you.