Fix: EPrints 3.4.7 /cgi HTTPS Redirect Loop (Certbot + Apache)

Problem

When enabling HTTPS using Certbot, EPrints /cgi endpoints (e.g. /cgi/users/login) return:

302 → same URL (infinite redirect)

Main site works, but only /cgi loops.

---

Root Cause

Certbot generates its own SSL vhost:

/opt/eprints3/cfg/apache/{repoid}-le-ssl.conf

However, it omits required EPrints directives, specifically:

PerlSetVar EPrints_Secure yes

Without this:

• EPrints does not recognize request as secure
• Session/login handler fails
• Results in infinite redirect loop on /cgi

---

Correct Reference

Check original EPrints SSL template:

/opt/eprints3/cfg/apache_ssl/{repoid}.conf

It contains:

<Location "">
  PerlSetVar EPrints_ArchiveID {repoid}
  PerlSetVar EPrints_Secure yes

  Options +ExecCGI
  Require all granted
</Location>

👉 This is the missing piece

---

Fix

Edit Certbot-generated SSL config:

/opt/eprints3/cfg/apache/{repoid}-le-ssl.conf

Update <Location> block

<Location "">
  PerlSetVar EPrints_ArchiveID {repoid}
  PerlSetVar EPrints_Secure yes

  Options +ExecCGI
  Require all granted
</Location>

---

Optional Improvement

You may scope it more safely:

<Location "/cgi">
  PerlSetVar EPrints_ArchiveID {repoid}
  PerlSetVar EPrints_Secure yes

  Options +ExecCGI
  Require all granted
</Location>

---

Required EPrints Config (10_core.pl)

Ensure consistency:

$c->{host} = 'repository.domain.ac.id';
$c->{port} = 80;

$c->{securehost} = 'repository.domain.ac.id';
$c->{secureport} = 443;

$c->{secure_cookies} = 0;
$c->{session_cookie_secure} = 0;

$c->{cookie_path} = "/";
$c->{cookie_domain} = "repository.domain.ac.id";

$c->{https_only} = 0;

$c->{http_url} = 'https://repository.domain.ac.id';
$c->{http_cgiurl} = 'https://repository.domain.ac.id/cgi';
$c->{base_url} = "https://$c->{host}";

$c->{session_driver} = 'File';
$c->{session_path} = '/opt/eprints3/var/session';

---

Why This Works

EPrints relies on:

PerlSetVar EPrints_Secure yes

to determine:

• request is HTTPS
• enable secure session handling
• avoid redirect loop in login flow

Without it:

/cgi/users/login → redirect → same URL → loop

---

Verification

curl -IL https://repository.domain.ac.id/cgi/users/login

Expected:

200 OK
Set-Cookie: ...

---

Notes

• Certbot does not understand EPrints internals

• Always compare with:

  /opt/eprints3/cfg/apache_ssl/{repoid}.conf

• Do not rely solely on auto-generated SSL config

---

Summary

Issue	Cause	Fix
/cgi redirect loop	Missing EPrints_Secure	Add PerlSetVar EPrints_Secure yes
Works on HTTP, fails on HTTPS	Certbot incomplete config	Patch SSL vhost
No session cookie	EPrints not in secure mode	Enable secure flag

---

Key Takeaway

When using Certbot with EPrints 3.4.x, always manually restore missing EPrints-specific directives in SSL vhost.