Contao 4.13 removed the web Install Tool: where should HTTPS enforcement and custom CA trust now live?

Confirmed: HTTPS Enforcement Location in Contao 4.13

With the web Install Tool removed, HTTPS enforcement is now a two-layer concern:

1. Web server/reverse proxy level (primary): Configure TLS termination and HTTP-to-HTTPS redirects at Nginx, Apache, or your load balancer. This ensures traffic is encrypted before reaching PHP-FPM.
2. Application level (fallback): The CONTAO_FORCE_HTTPS environment variable still works, but it relies on $_SERVER['HTTPS'] being correctly set by your proxy. If the proxy doesn't pass this header, Contao cannot enforce HTTPS.

Custom CA Trust for Outbound Requests

Contao uses Guzzle for HTTP requests (e.g., extension checks). To trust your internal CA:

• Recommended: Add the internal CA certificate to the system-wide CA bundle (e.g., /etc/ssl/certs/ca-certificates.crt on Debian/Ubuntu, then run update-ca-certificates). This affects all system processes, including PHP.
• Alternative: If you cannot modify the system bundle, configure PHP's curl.cafile directive in php.ini to point to your internal CA file.
• Advanced: For per-client control, extend Contao's Guzzle factory to inject a custom CA, but this requires code changes.

Container Deployment: Verifying Environment Variables

In containerized setups, ensure CONTAO_FORCE_HTTPS is passed to the PHP-FPM process. Verify it's visible:

# Run inside the PHP container
php -r "echo getenv('CONTAO_FORCE_HTTPS') ?: 'NOT SET';"

# Or check via Contao's debug mode
php bin/console debug:container --env-vars | grep CONTAO

Verification Steps

1. HTTPS redirect: Test that HTTP requests return a 301 redirect:

   curl -I http://your-domain.com 2>/dev/null | grep -i location

2. Outbound CA trust: Create a test script that fetches an internal HTTPS endpoint using Guzzle.
3. Proxy headers: Ensure your reverse proxy sets HTTP_X_FORWARDED_PROTO to https when terminating TLS.

Key Assumptions and Uncertainties

• Assumed: Your reverse proxy correctly passes HTTPS=on or sets HTTP_X_FORWARDED_PROTO=https.
• Uncertain: The exact behavior of Contao's HTTPS middleware with various proxy configurations.
• Assumed: Your internal CA is properly formatted as a PEM file trusted by the system OpenSSL library.

One missing diagnostic detail that would refine this answer: Are you using a specific reverse proxy (e.g., Traefik, Caddy, Envoy) that handles TLS termination? If so, what headers does it pass to the PHP-FPM backend?